What’s Vulnerable › Vulnerabilities

CVE-2026-54784: CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-07-10
• Weakness: CWE-311

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.

Affected products

• CoreWCF: from 1.9.0, < 1.9.1

References

• https://github.com/CoreWCF/CoreWCF/commit/2afae08b2fa5288428df89e8161116b816cf6b4b
• https://github.com/CoreWCF/CoreWCF/commit/f216aa6929d41dc99cee098b1e69c260ec4c41c7
• https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
• https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqgg

Get alerted when CVE-2026-54784 or the next vulnerability affects your stack