{"items":[{"id":"NVI-00018507","kind":"vulnerability","title":"CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rpj7-hr7h-w6p9","CVE-2026-54774"],"plain_summary":"GitHub lists this reviewed advisory for CoreWCF.Primitives, CoreWCF.Primitives. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-32d40d100e83f82f482d3a14e262d28d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-19T20:46:48.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-32d40d100e83f82f482d3a14e262d28d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-32d40d100e83f82f482d3a14e262d28d","url":"https://github.com/advisories/GHSA-rpj7-hr7h-w6p9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rpj7-hr7h-w6p9","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:19:16.585Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-32d40d100e83f82f482d3a14e262d28d"],"technology":"CoreWCF.Primitives","known_exclusions":[],"conditions_summary":"### Impact\nWhen a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.\n\n#### Preconditions\nThe service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone","public_affected_ranges":["< 1.8.1"]},{"certainty":"source_listed","source_ids":["sr-32d40d100e83f82f482d3a14e262d28d"],"technology":"CoreWCF.Primitives","known_exclusions":[],"conditions_summary":"### Impact\nWhen a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.\n\n#### Preconditions\nThe service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone","public_affected_ranges":[">= 1.9.0, < 1.9.1"]}],"null_published_at":"2026-11-07T07:07:39.845Z","source_updated_at":"2026-06-19T20:46:48.000Z","source_disclosed_at":"2026-06-19T20:46:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:19:16.585Z"}],"next_cursor":null,"snapshot_revision":"42594"}