GHSA-9jr3-rj99-8jq3

Source

https://github.com/advisories/GHSA-9jr3-rj99-8jq3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9jr3-rj99-8jq3/GHSA-9jr3-rj99-8jq3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9jr3-rj99-8jq3

Aliases

CVE-2026-54779

Published

2026-06-19T20:47:02Z

Modified

2026-06-19T21:00:18.935368118Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

CoreWCF: SAML token replay protection is inoperative

Details

Impact

When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Provide your own implementation of ITokenReplayCache with the correct behavior.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:47:02Z",
    "nvd_published_at": null,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-294",
        "CWE-613"
    ]
}

References

Affected packages

NuGet / CoreWCF.Primitives

Package

Name: CoreWCF.Primitives; View open source insights on deps.dev
Purl: pkg:nuget/CoreWCF.Primitives

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.1

Affected versions

0.*

0.1.0-preview

0.1.0-preview-2

0.1.0

0.2.0

0.2.1

0.3.0

0.3.1

0.3.2

0.4.0

1.*

1.0.0-preview1

1.0.0-preview2

1.0.0

1.0.1

1.0.2

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.4.0-preview1

1.4.0

1.4.1

1.4.2

1.5.0-preview1

1.5.0

1.5.1

1.5.2

1.6.0

1.7.0

1.8.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9jr3-rj99-8jq3/GHSA-9jr3-rj99-8jq3.json"