CVE-2026-54784

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54784
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54784.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54784
Aliases
Published
2026-07-08T22:18:13.846Z
Modified
2026-07-11T03:53:38.466237212Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Details

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54784.json",
    "cwe_ids": [
        "CWE-311",
        "CWE-523"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/corewcf/corewcf

Affected ranges

Type
GIT
Repo
https://github.com/corewcf/corewcf
Events
Introduced
39b2f02978e497955a560c72b5ccdff5c0dbcda1
Fixed
2afae08b2fa5288428df89e8161116b816cf6b4b
Fixed
f216aa6929d41dc99cee098b1e69c260ec4c41c7
Fixed
1f7a0811da5128db40fd7b868ae0aac0c581f91f
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.9.0"
        },
        {
            "fixed": "1.9.1"
        }
    ]
}

Affected versions

v1.*
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54784.json"