What is CVE-2026-54784?

CVE-2026-54784 is a high-severity vulnerability in Corewcf, classified under Missing Encryption of Sensitive Data. CVSS score: 7.4/10. Published 2026-07-08.

How severe is CVE-2026-54784?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Corewcf

CVE-2026-54784

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCrede…

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Corewcf — versions >= 1.9.0, < 1.9.1

Weakness classification (CWE)

CWE-311 — Missing Encryption of Sensitive Data
CWE-523 — Unprotected Transport of Credentials

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-54784?: CVE-2026-54784 is a high-severity vulnerability in Corewcf, classified under Missing Encryption of Sensitive Data. CVSS score: 7.4/10. Published 2026-07-08.
How severe is CVE-2026-54784?: High severity. CVSS v3 base score is 7.4 out of 10.