Prior to versions 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is ineffective because the DefaultTokenReplayCache.TryAdd method fails to reject duplicate tokens when DetectReplayedTokens is enabled. This allows an attacker who has captured a valid SAML token to reuse it, thereby gaining unauthorized access. The flaw is related to improper handling of replay protection (CWE‑294) and improper disclosure of temporary credentials (CWE‑613).

All deployments of CoreWCF that run versions prior to 1.8.1 or 1.9.1 are affected. These versions are distributed under the CoreWCF:CoreWCF vendor name.

The CVSS score of 5.9 indicates a moderate risk, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Because the failure occurs at application level, an attacker must already obtain a valid token, but reuse of a captured token is straightforward once captured. The likely attack vector is a pre‑auth or post‑auth token capture, and the window of opportunity depends on the token lifetime. The flaw also involves improper management of temporary credentials (CWE‑613), which could be leveraged to elevate threat persistence.