# CoreWCF.Primitives (NuGet) vulnerabilities

8 known vulnerabilities (1 critical, 4 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.9.1 (Jun 16, 2026): no advisory affects it
- Newest unaffected release: 1.9.1 (Jun 16, 2026), the latest release
- Releases: 38 since 0.1.0 (Feb 19, 2021)
- Registry: https://www.nuget.org/packages/CoreWCF.Primitives
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-54782: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54781: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54784: 1.9.0 (1.9.1 is outside it)
- CVE-2026-54774: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54783: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54780: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54773: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
- CVE-2026-54779: 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)

## Advisories (8)

### [CVE-2026-54782](https://cve.now/CVE-2026-54782): CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

- Severity: Critical 10.0
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54781](https://cve.now/CVE-2026-54781): CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

- Severity: High 7.4
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54784](https://cve.now/CVE-2026-54784): CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

- Severity: High 7.4
- Published: Jul 8, 2026
- Affected: from 1.9.0, fixed in 1.9.1.
- Fixed in 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54774](https://cve.now/CVE-2026-54774): CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

- Severity: High 7.4
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54783](https://cve.now/CVE-2026-54783): CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

- Severity: High 7.4
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54780](https://cve.now/CVE-2026-54780): CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

- Severity: Low 3.7
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54773](https://cve.now/CVE-2026-54773): CoreWCF: WS-Security signature substitution via document-wide Signature lookup

- Severity: Medium 5.9
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

### [CVE-2026-54779](https://cve.now/CVE-2026-54779): CoreWCF: SAML token replay protection is inoperative

- Severity: Medium 5.9
- Published: Jul 8, 2026
- Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
- Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 1.9.1, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget/corewcf.primitives
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.