CVE-2026-54784: CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

June 19, 2026

When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.

References

github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqgg
github.com/advisories/GHSA-2288-8h3r-cqgg
nvd.nist.gov/vuln/detail/CVE-2026-54784

Code Behaviors & Features

Detect and mitigate CVE-2026-54784 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →