What’s Vulnerable › Vulnerabilities

CVE-2026-54779: CoreWCF: SAML token replay protection is inoperative

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-07-09
• Weakness: CWE-294

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.

Affected products

• CoreWCF: from 1.9.0, < 1.9.1; before 1.8.1

References

• https://github.com/CoreWCF/CoreWCF/commit/3800c4e2bb4c6fde00ddacefdc2221ef33d55621
• https://github.com/CoreWCF/CoreWCF/commit/7b0b5231cf21b4b5c1fc3caac9981f8bee43823f
• https://github.com/CoreWCF/CoreWCF/commit/84f8cff5a786b5aaa73448cb379d366a7df98238
• https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
• https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
• https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-9jr3-rj99-8jq3

Get alerted when CVE-2026-54779 or the next vulnerability affects your stack