CVE-2026-54784: CoreWCF Auth Bypass Vulnerability

CVE-2026-54784 Overview

CVE-2026-54784 is a cryptographic exposure vulnerability in CoreWCF, the .NET Core port of Windows Communication Foundation (WCF). In version 1.9.0, the SPNEGO SecurityContextToken (SCT) negotiation path fails to encrypt the proof key returned in the WS-Trust Request Security Token Response (RSTR). When a service uses TransportWithMessageCredential with Windows client credentials and session establishment, a passive network observer can recover the symmetric proof key. The issue is tracked as [CWE-311: Missing Encryption of Sensitive Data]. It is fixed in CoreWCF version 1.9.1.

Critical Impact
An observer who captures the RSTR can impersonate the authenticated Windows principal and decrypt or forge subsequent WS-SecureConversation traffic within the session.

Affected Products

CoreWCF 1.9.0 (SPNEGO SecurityContextToken negotiation path)
Services using TransportWithMessageCredential binding with Windows client credentials
Deployments relying on WS-SecureConversation session establishment over CoreWCF

Discovery Timeline

2026-07-08 - CVE-2026-54784 published to NVD
2026-07-08 - Last updated in NVD database
2026-07-08 - GitHub Security Advisory GHSA-2288-8h3r-cqgg published
CoreWCF 1.9.1 - Fix released via GitHub Release v1.9.1

Technical Details for CVE-2026-54784

Vulnerability Analysis

CoreWCF issues a SecurityContextToken during WS-Trust negotiation. The server wraps the symmetric proof key inside a RequestedProofToken element in the RSTR before returning it to the client. On .NET 8, CoreWCF 1.9.0 calls System.Net.Security.NegotiateAuthentication.Wrap with requestEncryption=false. This produces an integrity-only Message Integrity Code (MIC) token under platform GSS instead of a sealed SSPI EncryptMessage output. The proof key is therefore transmitted with integrity protection but no confidentiality. The legacy .NET Framework WindowsSspiNegotiation.Encrypt path enabled sealing by default, so the CoreWCF port silently regressed the guarantee.

Root Cause

The defect resides in src/CoreWCF.Primitives/src/CoreWCF/Security/NegotiateInternal/NTAuthenticationNet8.cs. The Encrypt implementation passed false for the requestEncryption parameter of NegotiateAuthentication.Wrap. The code also did not verify the isEncrypted output flag, so the caller could not detect the missing confidentiality. The negotiated package returned a MIC-only wrapper containing the plaintext proof key.

Attack Vector

An adversary positioned on the network path between client and CoreWCF service captures the RSTR message. Because the transport is not required to be TLS-protected when TransportWithMessageCredential is misconfigured or when message-level security alone is assumed sufficient, the wrapped RSTR travels observable. The attacker parses the RequestedProofToken, extracts the symmetric proof key, and derives the WS-SecureConversation session keys. The attacker can then impersonate the authenticated Windows principal, decrypt traffic, and forge signed messages within that session.

csharp

// Patched code from NTAuthenticationNet8.cs
// SECURITY: requestEncryption MUST be true. Encrypt() backs ISspiNegotiation.Encrypt which
// SspiNegotiationTokenAuthenticator.IssueServiceToken uses to wrap the SecurityContextToken
// proof key into the RequestedProofToken returned in the WS-Trust RSTR. Wrapping with
// requestEncryption=false produces an integrity-only (MIC) token under platform GSS, which
// would expose the symmetric proof key in cleartext to any passive network observer when
// the binding is not protected by TLS.
var statusCode = (int)(((dynamic)_negotiateAuthentication).Wrap(
    input, (IBufferWriter<byte>)pipeWriter, true, out bool isEncrypted));
pipeWriter.FlushAsync().GetAwaiter().GetResult();

var errorCode = ToErrorCode(statusCode);
if (errorCode != NegotiateInternalSecurityStatusErrorCode.OK)
{
    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(
        new SecurityNegotiationException(SR.Format(SR.SspiWrapFailed, errorCode)));
}

Source: CoreWCF commit 2afae08

Detection Methods for CVE-2026-54784

Indicators of Compromise

Unexpected WS-Trust RSTR responses on the wire where the RequestedProofToken element contains a wrapped blob smaller than would be expected for a sealed SSPI output.
CoreWCF service processes running assemblies with CoreWCF.Primitives version 1.9.0.
WS-SecureConversation sessions originating from client IPs that do not match the authenticated principal's typical source range.

Detection Strategies

Inventory .NET services and enumerate NuGet package references to locate CoreWCF.Primitives at version 1.9.0.
Inspect service bindings for TransportWithMessageCredential combined with WindowsClientCredentialType and establishSecurityContext=true.
Capture SPNEGO negotiation traffic in a lab and validate whether the RSTR proof key is integrity-only versus sealed.

Monitoring Recommendations

Alert on Windows authentication events from CoreWCF hosts that originate from unexpected client identities or geographies.
Track anomalous session reuse or long-lived WS-SecureConversation contexts against baseline usage.
Monitor for downgrades to non-TLS transport on endpoints that host CoreWCF message-credential bindings.

How to Mitigate CVE-2026-54784

Immediate Actions Required

Upgrade CoreWCF.Primitives and related CoreWCF packages to version 1.9.1 or later.
Enforce TLS on every endpoint that uses TransportWithMessageCredential, treating transport confidentiality as mandatory rather than optional.
Rotate any Windows account credentials or downstream secrets that may have been reused within compromised WS-SecureConversation sessions.

Patch Information

The fix ships in CoreWCF 1.9.1. The patch changes NegotiateAuthentication.Wrap to request encryption and adds a fail-closed check on the isEncrypted output flag. New resource strings SspiWrapFailed and SspiWrapDidNotEncrypt cause the negotiation to throw SecurityNegotiationException if the negotiated package cannot provide confidentiality. See GitHub Security Advisory GHSA-2288-8h3r-cqgg and commits 2afae08 and f216aa6.

Workarounds

Wrap the affected endpoints in TLS at the transport layer so that the RSTR proof key is not observable on the network.
Disable session establishment on affected bindings where WS-SecureConversation is not strictly required, forcing per-message security instead.
Restrict network paths between clients and CoreWCF hosts to trusted segments while the upgrade to 1.9.1 is scheduled.

bash

# Update CoreWCF packages to the patched release
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1
dotnet add package CoreWCF.NetTcp --version 1.9.1

# Verify the resolved version in the built application
dotnet list package --include-transitive | grep -i CoreWCF