CoreWCF is a port of the Windows Communication Foundation service side to .NET Core. Prior to v1.8.1 and v1.9.1, the library’s SAML 1.1 and SAML 2.0 token validation logic fails to correctly resolve the issuer signing key and does not enforce signed tokens when IdentityConfiguration is used with federated bindings. This flaw allows an unauthenticated remote attacker to forge a SAML token that the trusted STS could issue and send it to a CoreWCF endpoint, resulting in the attacker being authenticated as any principal the STS could generate. Such authentication bypass can lead to unauthorized access, privilege escalation, or complete compromise of the system. This weakness is categorized as CWE‑290 and CWE‑347, and has been fixed in CoreWCF releases 1.8.1 and 1.9.1.

All CoreWCF deployments that use SAML 1.1 or SAML 2.0 token validation with federated bindings and run versions earlier than 1.8.1 for the 1.8 series or earlier than 1.9.1 for the 1.9 series are affected. Applications incorporating CoreWCF 1.8.0 or earlier, or CoreWCF 1.9.0, that rely on IdentityConfiguration for authentication are vulnerable.

The vulnerability has a CVSS score of 10, indicating critical severity, and an EPSS score of less than 1%, showing a very low but non‑zero exploitation probability. Because the flaw allows an unauthenticated attacker to transmit forged SAML tokens to an exposed CoreWCF endpoint, the attack vector is remote over the network. The issue is not currently listed in the CISA KEV catalog.