CVE-2026-54774

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1

Description The SamlSerializer skips the final SignatureValue verification when a service validates SAML tokens using a non-X.509 signing token. This occurs when the service is configured to authenticate using SAML tokens and an out-of-band token resolver holds a non-X.509 SecurityToken whose key identifier can be referenced in the assertion's <KeyInfo>, such as a BinarySecretSecurityToken representing a symmetric proof key. This allows an attacker to bypass assertion signature verification.

Recommendations Update CoreWCF to version 1.8.1. Update CoreWCF to version 1.9.1.