Security Risk Category

soap Security Risks

Published vulnerability pages connected to soap. One risk can appear in multiple categories while keeping one canonical page.

soap risks

Showing 1 of 1 published risks.

mediumEPSS 0.002

CoreWCF WS-Security Document-Wide Signature Lookup Bypass Vulnerability

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause WSSecurityOneDotZeroReceiveSecurityHeader to verify an attacker-supplied signature instead of the security header signature. This issue is fixed in versions 1.8.1 and 1.9.1.

CVE-2026-54773corewcfdotnetnugetwcf

Updated Jul 10, 2026