CVE-2026-54782 CRITICAL

CVE-2026-54782: CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

Vendor Corewcf
Product CoreWCF
Weakness CWE-290
Published July 8, 2026
Last update July 10, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-41134 WordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerability CVE-2024-37430 WordPress Patreon WordPress plugin <= 1.9.0 - Image Protection Bypass vulnerability CVE-2024-45453 WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability CVE-2023-37865 WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability CVE-2025-69401 WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability