CoreWCF is a .NET Core port of the WCF service side. Prior to versions 1.8.1 and 1.9.1, the framework’s SAML token validation does not enforce SubjectConfirmation method URIs or holder‑of‑key proof keys in the SamlSecurityTokenHandler. This omission allows holder‑of‑key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion, effectively enabling forged SAML tokens that bypass authentication. The issue is fixed starting with versions 1.8.1 and 1.9.1. The weakness corresponds to Authentication Bypass (CWE‑287) and Missing authentication of message signers (CWE‑345).

The vulnerability affects all releases of CoreWCF earlier than 1.8.1 and 1.9.1. Users deploying CoreWCF versions 1.0 through 1.8.0, or 1.9.0, are susceptible because their token validation logic omits critical checks on SubjectConfirmation and holder‑of‑key proof keys.

With a CVSS score of 7.4, the vulnerability represents a medium‑to‑high risk. The EPSS score is less than 1%, and the issue is not listed in CISA KEV, suggesting limited publicly known exploit activity. Based on the description, it is inferred that the likely attack vector is remote adversaries who can deliver forged SAML assertions to the service’s endpoint. No special privileges are required beyond the ability to send a SAML token, so the risk of exploitation remains significant if the system accepts externally supplied SAML assertions.