What is GHSA-xjr9-gg9q-jx3v?

GHSA-xjr9-gg9q-jx3v is a security advisory published by GitHub Security Advisories with Critical severity. CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

Which CVE IDs does GHSA-xjr9-gg9q-jx3v cover?

GHSA-xjr9-gg9q-jx3v covers the following CVE IDs: CVE-2026-54782. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xjr9-gg9q-jx3v?

GHSA-xjr9-gg9q-jx3v has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-xjr9-gg9q-jx3v?

GHSA-xjr9-gg9q-jx3v affects 2 products, including: nuget/CoreWCF.Primitives:\u003c 1.8.1; nuget/CoreWCF.Primitives:\u003e= 1.9.0, \u003c 1.9.1.

GHSA-xjr9-gg9q-jx3vCriticalCVSS 10.0

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-54782 →

📋 Description

Impact

Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.

Preconditions

Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

🎯 Affected products2

nuget/CoreWCF.Primitives:< 1.8.1
nuget/CoreWCF.Primitives:>= 1.9.0, < 1.9.1