CoreWCF SAML Token Signature Validation Authentication Bypass (CVE-2026-54782)
Vulnerability Overview
CVE-2026-54782 is a critical authentication bypass (CVSS 10.0) rooted in two closely related weaknesses: improper authentication via forged credentials (CWE-290) and insufficient verification of cryptographic signature (CWE-347). The root cause lies in CoreWCF's handling of SAML 1.1 and 2.0 tokens — specifically, the library accepts assertions with invalid or entirely absent signatures as valid. Because WCF service endpoints rely on this validation as their authentication gate, a successful exploit grants an unauthenticated attacker full access to any endpoint protected by SAML-based security bindings.
The impact is total: no credentials, no certificate, no session token required. An attacker who can reach the service endpoint can impersonate any identity, including privileged service accounts, by crafting a self-signed or unsigned SAML assertion and presenting it directly.
Affected Software
The vulnerability affects the CoreWCF.Primitives NuGet package across two version ranges:
CoreWCF.Primitives < 1.8.1CoreWCF.Primitives >= 1.9.0, < 1.9.1
Organizations consuming CoreWCF in .NET service applications — particularly those migrating legacy WCF workloads to modern .NET — should audit their NuGet dependency trees immediately. Any application using SAML federation with an affected version is exposed regardless of infrastructure controls.
Exploitation Status
A public proof-of-concept exists as of the disclosure date (2026-06-19). This significantly compresses the window between disclosure and active exploitation. The CVSS 10.0 score, combined with a working PoC and the prevalence of CoreWCF in enterprise .NET modernisation projects, makes this a high-priority target for opportunistic and targeted actors alike.
Defenders should treat this as actively exploitable. Patch availability should be confirmed (no patched release date is recorded at time of writing) and interim mitigations — network segmentation, WAF rules blocking malformed SAML assertions, and monitoring — should be applied immediately.
How Our Detection Catches It
Our detection engineering team has shipped coverage across seven SIEM platforms for CVE-2026-54782. The detection strategy focuses on two complementary signal sources:
- Signature anomalies in SAML traffic: Queries look for SAML assertions reaching WCF endpoints where the signature element is absent, malformed, or does not match any trusted signing certificate. This is the core indicator of the bypass technique.
- Authentication success without preceding credential challenge: Correlating successful service authentication events against the absence of expected upstream identity provider interactions surfaces sessions that may have been established via forged tokens.
Coverage is available for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). Each query is tuned to the telemetry model of its respective platform, targeting WCF endpoint logs, Windows Security event channels, and network proxy or WAF feeds where available.
Recommended Tuning
Because legitimate SAML flows always carry valid signatures from a known IdP, false-positive rates for the signature-absence signal are expected to be very low. Teams should baseline their environments against known IdP certificate thumbprints and alert on any deviation.
Full Detection & Query Access
The complete detection rules — including all seven SIEM queries, atomic test cases, and purple team playbook — are available on the CVE-2026-54782 detection page. Free-tier users can review the detection logic; playbook and atomic test access requires a paid subscription.