SecBoard
Zurück zur CVE-Übersicht

CVE-2026-54774

HIGH(7.4)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Risk Signal Score29/100 — MITTEL
  • CVSS 7.4 — Hoch
  • Weniger als 24 Stunden alt

Beschreibung

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in versions 1.8.1 and 1.9.1.

GitHub Advisories

GHSA-rpj7-hr7h-w6p9HIGH

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

nuget/CoreWCF.Primitives→ 1.8.1
GitHub Advisory

Referenzen