CoreWCF SAML SubjectConfirmation methods and holder-of-key proof keys bypass (GHSA-48pq-2xq3-c2m4)

Vulnerability Overview Vulnerability Name: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced Vulnerability ID: GHSA-48pq-2xq3-c2m4 Publication Date: June 16, 2026 Severity: High (CVSS v3 base metrics: 7.4/10) Scope Affected Versions: CoreWCF.Primitives (NuGet) 18.0, 19.0 Fixed Versions: CoreWCF.Primitives (NuGet) 18.1, 19.1 Description This vulnerability allows an attacker to bypass the validation of SubjectConfirmation methods and holder-of-key proof keys in SAML assertions, thereby gaining unauthenticated access. This manifests in two specific attack scenarios: 1. Holder-of-Key Downgrade: An attacker can obtain a holder-of-key SAML assertion issued by a non-Keycloak issuer, present it to the service, and bypass the proof key validation. 2. Custom Method Bypass: An attacker can submit a SAML assertion with a non-standard confirmation method URI or construct an assertion client-side to bypass the issuer signature validation, thereby circumventing per-method policies. Prerequisites The service must be configured to accept SAML 1.1 tokens via federation. Typical bindings include and , or any custom binding using with a SAML 1.1 token type. The attacker must possess at least one signed SAML 1.1 assertion that triggers the bypass mechanism. Remediation Fixed Versions: CoreWCF v1.8.1 and v1.9.1 Workaround Require the trusted Security Token Service (STS) to issue SAML assertions where the is not any method defined in SAML 1.1, or to issue holder-of-key SAML assertions without Keycloak involvement. If no trusted STS is willing to issue SAML assertions meeting these conditions, the service is unaffected. Additional Information CVE ID: CVE-2026-54781 Weaknesses: CWE-287, CWE-345 Summary This vulnerability relates to issues with the validation of SubjectConfirmation methods and holder-of-key proof keys in SAML assertions, potentially leading to unauthenticated access. It is recommended to upgrade to CoreWCF v1.8.1 and v1.9.1 to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CoreWCF SAML SubjectConfirmation methods and holder-of-key proof keys bypass (GHSA-48pq-2xq3-c2m4)

More from this source