CoreWCF is a .NET Core implementation of Windows Communication Foundation. In all releases before 1.8.1 and 1.9.1, the SamlSerializer component omits the final SignatureValue verification when a service validates a SAML token that is signed with a non‑X.509 signing token. This omission allows an attacker to construct a SAML assertion that references a non‑X.509 SecurityToken key identifier and bypass the assertion signature verification, effectively breaking authentication. The flaw represents a cryptographic verification failure (CWE‑345) and a missing non‑cryptographic security check (CWE‑347). The vulnerability is fixed in the 1.8.1 and 1.9.1 releases, which reinstate proper signature verification.

The issue targets CoreWCF:CoreWCF deployments running any version older than 1.8.1 or 1.9.1, regardless of host operating system, including any services that validate SAML tokens using non‑X.509 signing tokens.

The CVSS score of 7.4 reflects a high risk level, while the EPSS score of < 1 % indicates that public exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, as SAML assertions are typically transmitted over a network to services that perform validation. An attacker who can supply crafted SAML tokens would exploit the missing signature verification, potentially subverting authentication enforcement.