CVE-2026-54773

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1

Description WS-Security signature verification performs a document-wide ds:Signature lookup. An unauthenticated remote attacker can place a SOAP header before wsse:Security and embed a ds:Signature of their choosing, causing the WSSecurityOneDotZeroReceiveSecurityHeader function to verify the attacker-supplied signature instead of the security header signature. Exploitation requires the endpoint to be configured with an endorsing supporting token binding and the attacker to construct a ds:Signature whose KeyInfo resolves through the receive-side token resolver to a key under the attacker's control.

Recommendations Update to version 1.8.1. Update to version 1.9.1. Use a security token resolver that only accepts references to issuer-pinned X.509 chains.