CVE-2026-54783: CoreWCF Auth Bypass Vulnerability

CVE-2026-54783 Overview

CVE-2026-54783 is an improper authentication vulnerability [CWE-294] in CoreWCF, the .NET Core port of Windows Communication Foundation (WCF). Prior to versions 1.8.1 and 1.9.1, the WS-Security endorsing and supporting signature verification logic does not confirm that the selected ds:Signature element covers the expected Security header target. An attacker who captures a single signed SOAP envelope can replay it against the service and invoke arbitrary operations under the victim principal's identity. The flaw affects any CoreWCF-hosted service that relies on WS-Security message-level signatures for authentication.

Critical Impact
A captured signed SOAP envelope can be replayed to execute arbitrary service operations as the signing principal, bypassing message authentication.

Affected Products

CoreWCF versions prior to 1.8.1 (1.8.x branch)
CoreWCF versions prior to 1.9.1 (1.9.x branch)
.NET services using CoreWCF WS-Security endorsing or supporting signatures

Discovery Timeline

2026-07-08 - CVE-2026-54783 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54783

Vulnerability Analysis

CoreWCF implements WS-Security to provide message-level authentication and integrity for SOAP services. Endorsing and supporting signatures are XML digital signatures (ds:Signature) embedded in the SOAP Security header. They cryptographically bind a signing token to specific message elements such as the Timestamp, Body, or message identifier.

The verification path in vulnerable releases validates that a signature is cryptographically correct but does not verify that the signature covers the intended Security header target. As a result, the runtime accepts any ds:Signature whose references are internally consistent, regardless of what content those references actually protect.

An attacker who obtains one signed SOAP envelope can craft a new envelope containing arbitrary operation parameters while embedding the original ds:Signature block. CoreWCF associates the signature with the caller's principal and processes the replayed request as authenticated. This yields impersonation of the original signer and unauthorized invocation of service operations.

Root Cause

The root cause is missing validation that the accepted ds:Signature element covers the correct Security header target elements. The verification routine iterates candidate signatures and matches on cryptographic validity rather than on the specific URI references and transforms required by the binding policy.

Attack Vector

Exploitation requires a network path to the CoreWCF endpoint and a single previously observed signed SOAP envelope. The attacker constructs a SOAP message that reuses the captured signature block and submits it to the service. No user interaction and no prior privileges on the target are required, though the high attack complexity reflects the need to capture a valid signed envelope. See the GitHub Security Advisory GHSA-gqv6-pwcg-87r8 for detailed technical analysis.

Detection Methods for CVE-2026-54783

Indicators of Compromise

SOAP requests containing ds:Signature elements whose Reference URI values do not match the elements they purportedly protect.
Repeated SOAP envelopes reusing identical signature values, digest values, or wsu:Id identifiers across distinct message bodies.
Service operations invoked from client IP addresses or user agents that differ from historical patterns for the associated signing certificate or token.

Detection Strategies

Inspect WS-Security headers at the ingress layer and reject messages where ds:Reference targets do not include the Body, Timestamp, and any policy-required elements.
Correlate signing token identity with source network context to flag replays where the same signature appears from unexpected origins.
Enable verbose CoreWCF security tracing and alert on anomalous frequencies of authenticated calls tied to a single signing token.

Monitoring Recommendations

Ingest CoreWCF service logs and reverse proxy access logs into a centralized analytics platform for cross-source correlation.
Baseline normal call rates per signing identity and alert on sudden spikes, off-hours activity, or unusual operation mixes.
Retain full SOAP envelopes for authenticated calls long enough to support forensic reconstruction if replay is suspected.

How to Mitigate CVE-2026-54783

Immediate Actions Required

Upgrade CoreWCF to version 1.8.1 on the 1.8.x branch or 1.9.1 on the 1.9.x branch as documented in the CoreWCF Release v1.8.1 and CoreWCF Release v1.9.1 notes.
Inventory all internal and external services built on CoreWCF and identify those using WS-Security endorsing or supporting signatures.
Rotate any signing credentials that may have been captured, and review authentication logs for unexpected operation invocations.

Patch Information

The maintainers addressed the verification gap in the commits referenced in the advisory, including commit 0589692, commit 30aef80, and commit 4618f24. Update the CoreWCF.* NuGet package references in project files and redeploy affected services.

Workarounds

If immediate patching is not possible, place CoreWCF services behind a gateway that performs strict WS-Security policy enforcement and validates that signatures cover the Body and Timestamp.
Enforce short-lived wsu:Timestamp windows and strict nonce tracking to reduce the replay window for captured envelopes.
Restrict endpoint reachability to trusted network segments and require transport-layer authentication in addition to message-level signatures.

bash

# Update CoreWCF package references to a fixed release
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1
dotnet add package CoreWCF.WebHttp --version 1.9.1
dotnet restore
dotnet build -c Release