CVE-2026-54782: CoreWCF Auth Bypass Vulnerability

CVE-2026-54782 Overview

CVE-2026-54782 is an authentication bypass vulnerability in CoreWCF, a port of the server-side Windows Communication Foundation (WCF) to .NET Core. The flaw exists in SAML 1.1 and SAML 2.0 token validation logic when IdentityConfiguration is used with federated bindings. CoreWCF fails to correctly resolve the issuer signing key and does not require signed tokens. An unauthenticated remote attacker can impersonate any principal that the trusted Security Token Service (STS) is capable of issuing. The issue is fixed in CoreWCF versions 1.8.1 and 1.9.1. This vulnerability maps to [CWE-290] Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated remote attackers can forge SAML tokens to impersonate any principal the trusted STS could issue, bypassing federated authentication entirely.

Affected Products

CoreWCF versions prior to 1.8.1 (1.8.x branch)
CoreWCF versions prior to 1.9.1 (1.9.x branch)
Applications using IdentityConfiguration with federated SAML bindings

Discovery Timeline

2026-07-08 - CVE-2026-54782 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54782

Vulnerability Analysis

CoreWCF implements SAML token validation through the SamlTokenValidationParameters class in src/CoreWCF.Primitives/src/CoreWCF/IdentityModel/Tokens/. The vulnerable configuration assigned a custom SignatureValidator delegate without setting an IssuerSigningKeyResolver and without setting RequireSignedTokens to true. This combination allowed the validation pipeline to accept tokens whose signatures were not verified against the STS-configured issuer signing keys.

Because the trusted STS's public signing key was never resolved during validation, tokens could be crafted or replayed without a cryptographic binding to the trusted issuer. Federated bindings that rely on SAML assertions therefore accepted attacker-supplied claims as authoritative, including arbitrary NameID and role claims.

Root Cause

The root cause is improper configuration of the underlying token validation parameters. The custom SignatureValidator short-circuited signature enforcement while RequireSignedTokens remained false and no IssuerSigningKeyResolver was registered. Validation therefore did not require a cryptographically signed token bound to the trusted issuer's key material.

Attack Vector

Exploitation is network-based, requires no privileges, and no user interaction. An attacker sends a crafted SAML 1.1 or SAML 2.0 assertion to a CoreWCF endpoint using a federated binding backed by IdentityConfiguration. The service accepts the assertion, extracts claims, and issues an authenticated session for any principal named in the token, including administrative identities.

text

// Security patch applied to SamlTokenValidationParameters.cs
             //start of Issuer validation
             tokenValidationParams.IssuerValidator = IssuerValidate;
             tokenValidationParams.PropertyBag.Add(SAML_SECURITY_TOKEN, securityToken);
-            tokenValidationParams.SignatureValidator = SignValidator;
+            tokenValidationParams.IssuerSigningKeyResolver = ResolveIssuerSigningKey;
+            tokenValidationParams.RequireSignedTokens = true;
             tokenValidationParams.ClockSkew = securityHandlerConfiguration.MaxClockSkew;
             return tokenValidationParams;
         }
// Source: https://github.com/CoreWCF/CoreWCF/commit/0b8c8af851260e85e8402af53233d1b8f87dfb6f

The patch replaces the permissive SignatureValidator with an IssuerSigningKeyResolver and enforces RequireSignedTokens = true, ensuring every SAML assertion is cryptographically bound to a trusted issuer key.

Detection Methods for CVE-2026-54782

Indicators of Compromise

Unexpected authentication events for high-privilege principals originating from external or unusual IPs against CoreWCF federated endpoints.
SAML assertions in traffic captures lacking a <ds:Signature> element or containing signatures that do not chain to the configured STS certificate.
Multiple distinct NameID values appearing in short succession from a single source against a CoreWCF service.

Detection Strategies

Inspect application logs from CoreWCF services for successful federated authentications where the incoming SAML token lacked a validated signature or referenced an unrecognized issuer.
Perform dependency inventory against CoreWCF.* NuGet packages and flag any version below 1.8.1 on the 1.8.x branch or below 1.9.1 on the 1.9.x branch.
Add web application firewall or reverse proxy rules to log SAML Response and Assertion payloads sent to CoreWCF endpoints for offline signature validation.

Monitoring Recommendations

Correlate STS-issued token counts with CoreWCF federated login counts; large deltas indicate tokens accepted without STS issuance.
Monitor for privilege escalation patterns following federated logins, including new administrative role assignments or access to sensitive services.
Enable verbose System.IdentityModel tracing on CoreWCF hosts and alert on SignatureValidator invocations that return success without resolving an issuer key.

How to Mitigate CVE-2026-54782

Immediate Actions Required

Upgrade CoreWCF to 1.8.1 or 1.9.1 immediately across all services using federated bindings.
Audit all CoreWCF services that instantiate IdentityConfiguration and confirm they now enforce signed tokens.
Rotate any credentials, session tokens, or downstream secrets that could have been accessed through impersonated identities.

Patch Information

The maintainers released fixed builds in CoreWCF Release v1.8.1 and CoreWCF Release v1.9.1. The code fix is documented in the GitHub Security Advisory GHSA-xjr9-gg9q-jx3v and implemented across three commits: commit 0b8c8af, commit 0e63c2c, and commit e5cc9b6.

Workarounds

Where immediate patching is not possible, disable federated SAML bindings on affected CoreWCF endpoints until the upgrade completes.
Restrict network access to CoreWCF federated endpoints to trusted client networks using firewall or reverse proxy allowlists.
Enforce mutual TLS at the transport layer so that unauthenticated network callers cannot reach the vulnerable validation path.

bash

# Update CoreWCF packages in a .NET project to the fixed versions
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1
dotnet add package CoreWCF.WebHttp --version 1.9.1
dotnet restore
dotnet build --configuration Release

# Verify no vulnerable versions remain in the dependency tree
dotnet list package --include-transitive | grep -i corewcf