CoreWCF, a port of the service side of Windows Communication Foundation (WCF) to .NET Core, implements WS‑Security 1.0. Prior to 1.8.1 and 1.9.1, the CoreWCF WS‑Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA‑1 while the message is still accepted. This issue is fixed in versions 1.8.1 and 1.9.1. The result is that an attacker can embed a reference that uses a weak digest algorithm, and the server will still accept the message, undermining the integrity guarantees of WS‑Security and allowing apparently authentic messages to be crafted with a weaker digest algorithm, as identified by CWE‑327 and CWE‑757.

Affected systems are CoreWCF implementations prior to versions 1.8.1 and 1.9.1. The CoreWCF library, a port of Windows Communication Foundation, is used in .NET Core applications that rely on WS‑Security 1.0 for message signing. Any application or service that imports CoreWCF CoreWCF before the specified releases runs the risk because the digest algorithm in signed references is not validated. The vulnerability affects all hosts running affected CoreWCF versions, regardless of the particular platform or deployment model.

The CVSS score of 3.7 reflects a low severity. The vulnerability is remotely exploitable via a crafted WS‑Security message, but it does not provide direct code execution or privilege escalation. The EPSS score of < 1% indicates a very low probability of exploitation in the current data set, and the issue is not listed in the CISA KEV catalog. The attack would require the attacker to be able to send a WS‑Security request to a CoreWCF endpoint that accepts signed messages.