The vulnerability is a CWE-306 authentication bypass in CoreWCF, a .NET Core port of Windows Communication Foundation. Services exposed via Unix Domain Sockets that employ PosixIdentity client credentials could accept client connections that circumvent the required application/unixposix stream upgrade before messages are dispatched. Because the framing‑layer identity checks in UnixPosixIdentitySecurityUpgradeProvider are skipped, unauthenticated clients can reach the service layer. The flaw is present in all CoreWCF releases earlier than 1.8.1 and 1.9.1 and is resolved by upgrading to those versions.

The flaw affects CoreWCF:CoreWCF versions prior to 1.8.1 and prior to 1.9.1 on Unix-based operating systems. Users running any of these versions are exposed to this vulnerability. The EPSS score is below 1%, and the issue is not listed in the CISA KEV catalog. Attack attempts require ability to reach the Unix Domain Socket; this is implied by the description that connections can skip the required security upgrade before message dispatch.

The risk is moderate; a CVSS score of 4.4 indicates medium severity, while the EPSS score is below 1%, indicating a low probability of exploitation. The upgrade step is bypassed, allowing unauthenticated clients to interact with the service until a patch is applied. Attackers who can reach the Unix Domain Socket may exploit this vulnerability. The vulnerability is not listed in the CISA KEV catalog.