What is GHSA-9jr3-rj99-8jq3?

GHSA-9jr3-rj99-8jq3 is a security advisory published by GitHub Security Advisories with Medium severity. CoreWCF: SAML token replay protection is inoperative

Which CVE IDs does GHSA-9jr3-rj99-8jq3 cover?

GHSA-9jr3-rj99-8jq3 covers the following CVE IDs: CVE-2026-54779. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9jr3-rj99-8jq3?

GHSA-9jr3-rj99-8jq3 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-9jr3-rj99-8jq3?

GHSA-9jr3-rj99-8jq3 affects 2 products, including: nuget/CoreWCF.Primitives:\u003c 1.8.1; nuget/CoreWCF.Primitives:\u003e= 1.9.0, \u003c 1.9.1.

GHSA-9jr3-rj99-8jq3MediumCVSS 5.9

CoreWCF: SAML token replay protection is inoperative

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-54779 →

📋 Description

Impact

When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Provide your own implementation of ITokenReplayCache with the correct behavior.

🎯 Affected products2

nuget/CoreWCF.Primitives:< 1.8.1
nuget/CoreWCF.Primitives:>= 1.9.0, < 1.9.1

🔗 References (2)

https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-9jr3-rj99-8jq3
https://github.com/advisories/GHSA-9jr3-rj99-8jq3