CVE-2026-54782

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1

Description SAML 1.1 and SAML 2.0 token validation fails to correctly resolve the issuer signing key or enforce signed tokens when IdentityConfiguration is used with federated bindings. This occurs when the service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding, or any binding that triggers FederatedSecurityTokenManager for issued-token validation, and UseIdentityConfiguration is set to true. An unauthenticated remote attacker who knows the trusted Security Token Service (STS) public certificate can impersonate any principal the trusted STS could issue, including administrative principals.

Recommendations Update CoreWCF to version 1.8.1. Update CoreWCF to version 1.9.1.