CoreWCF SPNEGO SecurityContextToken Proof Key Exposure Vulnerability
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
Quick answer
CoreWCF should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- CoreWCF 1.9.0
Fixed versions
- 1.9.1
How to fix it
CoreWCF 1.9.0 exposed SPNEGO SecurityContextToken proof key material in affected credential negotiation flows. Upgrade to CoreWCF 1.9.1 or later and review Windows-authenticated service deployments for token or key exposure.
- Inventory .NET services using CoreWCF 1.9.0, especially services using SPNEGO, Windows credentials, or SecurityContextToken negotiation.
- Upgrade CoreWCF packages to 1.9.1 or a later fixed release across applications and shared libraries.
- Redeploy affected services and restart hosts so no vulnerable assemblies remain loaded.
- Review binding configuration for TransportWithMessageCredential, Windows authentication, and session-establishment settings.
- Rotate service account credentials, Kerberos-related secrets, and application tokens if proof key exposure is suspected.
- Audit service logs, authentication logs, and network telemetry for unusual replay, impersonation, or session reuse.
- Add package version checks to CI so CoreWCF 1.9.0 cannot be reintroduced.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm deployed applications reference CoreWCF 1.9.1 or later.
- Validate package lockfiles and runtime assemblies do not include CoreWCF 1.9.0.
- Test SPNEGO and Windows-authenticated service calls after the upgrade.
- Review logs for suspicious token reuse, replay, or failed authentication spikes.
- Run a Fixnx scan and confirm exposed service endpoints match the intended access model.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-54784?
CoreWCF versions listed as affected should be reviewed: CoreWCF 1.9.0.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
Why can this risk appear in multiple categories?
A vulnerability can belong to more than one platform or ecosystem. Fixnx keeps one canonical risk page while also listing it in every relevant category.