CoreWCF is a .NET Core version of Windows Communication Foundation’s service side. Prior to releases 1.8.1 and 1.9.1, its WS‑Security endorsement and support signature verification omitted a check that ensures the selected ds:Signature references the intended Security header, enabling an XML Signature Wrapping attack. An adversary who captures a legitimate signed SOAP envelope can replay it to execute arbitrary service operations as the victim’s identity. The vulnerability is resolved in CoreWCF 1.8.1 and 1.9.1.

The issue affects the CoreWCF product for .NET Core. Versions prior to 1.8.1 and 1.9.1 are vulnerable. The fix is available in CoreWCF releases 1.8.1 and 1.9.1, and all systems running an earlier release are at risk.

The CVSS score of 7.4 indicates a high impact vulnerability. The EPSS score is < 1%, suggesting the likelihood of exploitation is currently low and it is not listed in CISA's KEV catalog. The likely attack vector is over the network; an attacker with network access can intercept a signed SOAP message, capture it, and replay the message without requiring additional privileges. The missing verification step allows the attacker to replay a captured signed envelope.