VulnSocial

CVE-2026-54782Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-09); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-09: 1Mentions · 2026-07-17: 1Patch / Workaround · 2026-07-17: 1Technical Details · 2026-07-09: 1Technical Details · 2026-07-17: 107-0907-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-07-091
Disclosure1
2026-07-171
Patch1
Full discourse2 posts
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs
    Disclosure

    CVE-2026-54782 CoreWCF SAML token validation bypass could allow unauthenticated attackers to impersonate trusted principals, including administrators, in federated access deployments Analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-07-08/TIER_2_CVE-2026-54782.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement

    Post summary

    CVE-2026-54782 is a newly disclosed CoreWCF SAML token validation bypass that lets unauthenticated attackers impersonate administrators in federated deployments; no PoC, exploit, active exploitation, or patch information is provided.

    0101042
    57 followersView on X
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Patch

    Another reminder that trust is earned, not assumed. CVE-2026-54782. CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation Patch or mitigate before this gets walked into your environment.

    Post summary

    The message warns about CVE‑2026‑54782, a CoreWCF SAML authentication bypass, and urges users to apply patches or mitigations before deployment.

    0000049
    341 followersView on X

Explore more

Back to dashboard