CVE-2026-54784

### Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT. #### Preconditions Using security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation). ### Patches Fixed in CoreWCF v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.

### Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT. #### Preconditions Using security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation). ### Patches Fixed in CoreWCF v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.