CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service processes SAML tokens signed with a non-X.509 signing token. This flaw lets an attacker supply a SAML assertion that references a non-X.509 SecurityToken key identifier and bypasses assertion signature verification, effectively undermining authentication enforcement. The fix is implemented in versions 1.8.1 and 1.9.1.

The issue targets CoreWCF:CoreWCF deployments running any version older than 1.8.1 or 1.9.1, regardless of host operating system, including any services that validate SAML tokens using non-X.509 signing tokens.

The CVSS score of 7.4 reflects a high risk level, while the EPSS score of < 1 % indicates that public exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, as SAML assertions are typically transmitted over a network to services that perform validation. An attacker who can supply crafted SAML tokens would exploit the missing signature verification, potentially subverting authentication enforcement.