CoreWCF: WS-Security signature substitution via document-wide Signature lookup
Impact
An unauthenticated remote attacker who can place a SOAP header lexically before wsse:Security can embed a ds:Signature of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header.
Preconditions
Exploitation requires the endpoint be configured with an endorsing supporting token binding, and the attacker constructs a ds:Signature whose KeyInfo resolves through the receive-side token resolver to a key under the attacker’s control. Both are conditions outside the attacker’s direct control on a generic deployment.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Use a security token resolver that only accepts references to issuer-pinned X.509 chains (the default when expecting a static set of signing certificates).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | CoreWCF.Primitives | < 1.8.1, >= 1.9.0, < 1.9.1 | 1.8.1, 1.9.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-347- Platform
- .NET (NuGet)
- Package
CoreWCF.Primitives- Disclosed
- 19.06.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jc6x-rj79-w4mx - CC BY 4.0
Vulnerability history: CoreWCF.Primitives
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 06.2026 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 2
- Low 1
Disclosures per year
- 2026: 8
-
CoreWCF: WS-Security signature substitution via document-wide Signature lookup this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.