CoreWCF is a .NET Core port of the service side of Windows Communication Foundation. Prior to releases 1.8.1 and 1.9.1, its WS‑Security endorsing and supporting signature verification does not ensure that the selected ds:Signature covers the expected Security header target, allowing an attacker with a captured signed SOAP envelope to replay arbitrary service operations as the victim principal. The issue is fixed in releases 1.8.1 and 1.9.1.

The issue affects the CoreWCF product for .NET Core. Versions prior to 1.8.1 and 1.9.1 are vulnerable. The fix is available in CoreWCF releases 1.8.1 and 1.9.1, and all systems running an earlier release are at risk.

The CVSS score of 7.4 indicates a high impact vulnerability. The EPSS score is < 1%, suggesting the likelihood of exploitation is currently low, and it is not listed in CISA's KEV catalog. The likely attack vector is over the network; an attacker with network access can intercept a signed SOAP message, capture it, and replay the message without requiring additional privileges. The missing verification step allows the attacker to replay a captured signed envelope.