Prior to CoreWCF releases 1.8.1 and 1.9.1, the platform’s SAML token replay protection is ineffective because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled. This flaw allows an attacker who has captured a valid SAML token to reuse it, thereby gaining unauthorized access. The flaw involves improper replay protection handling (CWE‑294) and improper disclosure of temporary credentials (CWE‑613).

All deployments of CoreWCF that run versions before 1.8.1 or 1.9.1 are affected. These versions are identified under the vendor name CoreWCF:CoreWCF.

The CVSS score of 5.9 indicates a moderate risk, while the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Because replay protection is implemented at the application level, an attacker must first obtain a valid SAML token, but once captured the reuse of the token is straightforward. The likely attack vector is the capture of a token prior to its expiry; the window of opportunity depends on the token lifetime.