CoreWCF is a .NET Core port of the Windows Communication Foundation service side. In versions before 1.8.1 and 1.9.1, its WS‑Security signature verification performed a document‑wide ds:Signature lookup. This flaw enables an unauthenticated remote attacker to insert a SOAP header preceding the wsse:Security element, causing the WSSecurityOneDotZeroReceiveSecurityHeader routine to validate the attacker‑supplied signature in place of the legitimate security header, thereby bypassing authentication. The problem was addressed in releases 1.8.1 and 1.9.1.

The vulnerability affects the CoreWCF library in all releases prior to 1.8.1 and 1.9.1. Deployments that include these older versions are susceptible because the signature lookup logic is not constrained to the security header. Version 1.8.1 of CoreWCF and its subsequent 1.9.1 release contain the fix that removes the document‑wide lookup.

The CVSS score of 5.9 indicates medium severity. An EPSS of <1% indicates a low likelihood of exploitation. An unauthenticated remote attacker can send a crafted SOAP request to the service if it is exposed to the network, potentially forging authentication and accessing protected functionality. The medium severity and low exploitation probability suggest remediation should be prioritized for exposed endpoints.