CoreWCF is a .NET Core implementation of the Windows Communication Foundation service side. In releases prior to 1.8.1 and 1.9.1, its WS‑Security signature verification performs a document‑wide ds:Signature lookup. This flaw allows an unauthenticated remote attacker to insert a SOAP header before the wsse:Security element and cause the WSSecurityOneDotZeroReceiveSecurityHeader routine to validate the attacker‑supplied signature in place of the legitimate security header, effectively bypassing authentication. The vulnerability was addressed in CoreWCF 1.8.1 and 1.9.1.

The vulnerability affects the CoreWCF library in all releases prior to 1.8.1 and 1.9.1. Deployments that include these older versions are susceptible because the signature lookup logic is not constrained to the security header. Version 1.8.1 of CoreWCF and its subsequent 1.9.1 release contain the fix that removes the document‑wide lookup.

The CVSS score of 5.9 indicates medium severity. An EPSS of <1% indicates a low likelihood of exploitation. An unauthenticated remote attacker can send a crafted SOAP request to the service if it is exposed to the network, potentially forging authentication and accessing protected functionality. The medium severity and low exploitation probability suggest remediation should be prioritized for exposed endpoints.