CVE-2026-54779: CoreWCF Auth Bypass Vulnerability

CVE-2026-54779 Overview

CVE-2026-54779 is an authentication weakness in CoreWCF, the .NET Core port of the service side of Windows Communication Foundation (WCF). The DefaultTokenReplayCache.TryAdd method fails to reject duplicate Security Assertion Markup Language (SAML) tokens when DetectReplayedTokens is enabled. As a result, replay protection is inoperative, and an attacker who captures a valid SAML token can reuse it against the service. The flaw is classified under CWE-294: Authentication Bypass by Capture-replay. Versions prior to 1.8.1 and 1.9.1 are affected. Fixed builds are available in CoreWCF 1.8.1 and 1.9.1.

Critical Impact
An attacker with access to a captured SAML token can replay it to authenticate to a CoreWCF service, defeating the built-in replay defense and undermining message integrity guarantees.

Affected Products

CoreWCF versions prior to 1.8.1 (1.8.x branch)
CoreWCF versions prior to 1.9.1 (1.9.x branch)
Applications relying on DetectReplayedTokens for SAML replay protection

Discovery Timeline

2026-07-08 - CVE-2026-54779 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database
Fix commits published - Referenced in GitHub Security Advisory GHSA-9jr3-rj99-8jq3

Technical Details for CVE-2026-54779

Vulnerability Analysis

CoreWCF exposes a replay cache designed to store the identifiers of previously seen SAML tokens. When DetectReplayedTokens is enabled on the security binding, the framework is expected to consult this cache during token validation and reject any token whose identifier has already been recorded. The implementation in DefaultTokenReplayCache.TryAdd does not enforce this contract. It fails to signal a duplicate insertion, so the calling validation logic treats a previously seen token as if it were fresh. Because SAML tokens carry authenticated claims and can remain valid for the duration of their lifetime window, a captured token remains usable until it expires.

Root Cause

The defect lies in the TryAdd implementation of the default token replay cache. The method does not return a negative result when an identifier is already present, breaking the intended semantics of a replay-detection primitive. Fixes are distributed across three commits — 3800c4e2, 7b0b5231, and 84f8cff5 — and are packaged in the 1.8.1 and 1.9.1 releases.

Attack Vector

An attacker first captures a legitimate SAML bearer or holder-of-key token in transit or from a compromised client. The attacker then resubmits the token to the CoreWCF service endpoint within its validity window. Because the replay cache does not reject the duplicate, the service accepts the message and authenticates the request under the original subject's identity. Exploitation requires network access to the service and possession of a captured token, which is why the CVSS attack complexity is rated High.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-9jr3-rj99-8jq3 for authoritative technical details.

Detection Methods for CVE-2026-54779

Indicators of Compromise

Multiple successful SAML authentications using the same token identifier (AssertionID) within a short time window
Repeated service calls carrying identical SAML assertions from different source IP addresses
Successful authentications from network locations that do not match the token subject's normal usage patterns

Detection Strategies

Enable verbose logging of SAML AssertionID, issuer, and NotOnOrAfter values at the CoreWCF service and correlate duplicates
Deploy an application-layer rule that hashes inbound SAML assertions and flags repeat hashes seen within the token lifetime
Cross-reference authentication events with source IP, user agent, and TLS session fingerprints to surface reuse of a single token from multiple origins

Monitoring Recommendations

Ingest CoreWCF service logs and identity provider issuance logs into a centralized analytics platform for correlation
Alert on any SAML assertion presented more than once, regardless of DetectReplayedTokens configuration state
Track the CoreWCF assembly version in deployed services and inventory hosts still running versions earlier than 1.8.1 or 1.9.1

How to Mitigate CVE-2026-54779

Immediate Actions Required

Upgrade CoreWCF to version 1.8.1 (for the 1.8.x branch) or 1.9.1 (for the 1.9.x branch) as published on the CoreWCF releases page
Inventory all .NET Core services that reference the CoreWCF NuGet packages and prioritize those exposing SAML-authenticated endpoints
Rotate or shorten the lifetime of SAML tokens issued to CoreWCF services to reduce the window in which captured tokens remain valid

Patch Information

The issue is fixed in CoreWCF 1.8.1 and 1.9.1. The corrective changes are delivered in commits 3800c4e2, 7b0b5231, and 84f8cff5. Consumers should update the CoreWCF.* NuGet package references in their project files and redeploy the services. See the GitHub Security Advisory GHSA-9jr3-rj99-8jq3 for the full advisory.

Workarounds

Reduce SAML token lifetimes at the Security Token Service (STS) so captured tokens expire quickly
Enforce mutual TLS between clients and the CoreWCF service to limit the population of parties able to capture assertions
Add a custom ISecurityTokenReplayCache implementation that correctly rejects duplicate AssertionID values until the patched release is deployed

bash

# Update CoreWCF packages to the patched versions
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1
dotnet add package CoreWCF.WebHttp --version 1.9.1

# Verify installed version
dotnet list package | grep CoreWCF