CoreWCF is a port of the Windows Communication Foundation service side to .NET Core. Prior to releases 1.8.1 and 1.9.1, the WS‑Security 1.0 receive pipeline validates the signature method against the configured SecurityAlgorithmSuite but does not validate each reference's digest method. This allows a sender to use a rejected digest algorithm such as SHA‑1 while the message is still accepted, thereby undermining the integrity guarantees of WS‑Security.

Affected systems are applications that use the CoreWCF CoreWCF library before version 1.8.1 or 1.9.1. Those applications render signed messages containing deprecated digest algorithms as valid, exposing the services to integrity‑related attacks.

The CVSS score of 3.7 indicates low severity, and the EPSS score of <1% indicates a very low probability of exploitation. The likely attack vector is a remotely crafted WS‑Security request sent to a CoreWCF endpoint that accepts signed messages, as inferred from the description. The vulnerability does not provide a path to code execution or privilege escalation, but it does weaken the authenticity of signed messages, and it is not listed in the CISA KEV catalog.