GHSA-xjr9-gg9q-jx3v

Source

https://github.com/advisories/GHSA-xjr9-gg9q-jx3v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjr9-gg9q-jx3v/GHSA-xjr9-gg9q-jx3v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xjr9-gg9q-jx3v

Aliases

CVE-2026-54782

Published

2026-06-19T20:47:11Z

Modified

2026-06-19T21:00:17.218617748Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

Details

Impact

Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.

Preconditions

Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-19T20:47:11Z",
    "github_reviewed": true,
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-290",
        "CWE-347"
    ]
}

References

Affected packages

NuGet / CoreWCF.Primitives

Package

Name: CoreWCF.Primitives; View open source insights on deps.dev
Purl: pkg:nuget/CoreWCF.Primitives

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.1

Affected versions

0.*

0.1.0-preview

0.1.0-preview-2

0.1.0

0.2.0

0.2.1

0.3.0

0.3.1

0.3.2

0.4.0

1.*

1.0.0-preview1

1.0.0-preview2

1.0.0

1.0.1

1.0.2

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.4.0-preview1

1.4.0

1.4.1

1.4.2

1.5.0-preview1

1.5.0

1.5.1

1.5.2

1.6.0

1.7.0

1.8.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjr9-gg9q-jx3v/GHSA-xjr9-gg9q-jx3v.json"