CoreWCF SAML Token Signature Validation Authentication Bypass Vulnerability

Who is affected

How to fix it

CoreWCF SAML token validation before 1.8.1 and 1.9.1 can allow unauthenticated impersonation when federated bindings use IdentityConfiguration. Treat this as critical for WSFederationHttpBinding or WS2007FederationHttpBinding services and update immediately.

1. Inventory CoreWCF services using SAML 1.1 or SAML 2.0 with federated bindings and IdentityConfiguration.
2. Upgrade CoreWCF packages to 1.8.1, 1.9.1, or later across all relying-party services.
3. Validate trusted STS certificates, issuer metadata, audience restrictions, and token-signing configuration.
4. Temporarily restrict network access to federated CoreWCF endpoints until every service is patched.
5. Expire existing SAML sessions and force reauthentication for sensitive services.
6. Review authorization logs for unexpected principals, administrative claims, or impossible login patterns.
7. Rotate service credentials or signing trust configuration if forged or unsigned SAML tokens may have been accepted.

Verify the fix

• Confirm every affected service loads CoreWCF 1.8.1, 1.9.1, or later.
• Test that unsigned SAML tokens and tokens signed with the wrong issuer key are rejected.
• Verify federated services enforce issuer, audience, signature, and claim mapping rules.
• Review authentication logs for suspicious impersonation during the vulnerable window.
• Run a Fixnx scan and confirm federated SOAP endpoints are not publicly exposed beyond the intended access model.

Related categories

Trusted references

FAQ