CVE-2026-54779 CoreWCF: SAML token replay protection is inoperative
Attackers can reuse captured SAML tokens because replay protection fails when enabled, bypassing authentication controls in CoreWCF applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54779?
CVE-2026-54779 is a medium-severity vulnerability in CoreWCF, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.
Which versions are affected by CVE-2026-54779?
4 open source packages ship an affected version, including CoreWCF.Primitives.
| Package | Affected | Fixed in |
|---|---|---|
CoreWCF.Primitives NuGet | All versions | 1.8.1 |
CoreWCF.Primitives NuGet | All versions | 1.8.1 |
CoreWCF.Primitives NuGet | From 1.9.0 | 1.9.1 |
CoreWCF.Primitives NuGet | From 1.9.0 | 1.9.1 |
How do I fix CVE-2026-54779?
Upgrade CoreWCF.Primitives to a fixed version for your release line: 1.8.1 or 1.9.1.
Is CVE-2026-54779 being exploited?
There is no known exploitation of CVE-2026-54779 in the wild and no public exploit code.
Sources
Also known as GHSA-9jr3-rj99-8jq3.