CVE-2019-1006

CVE-2019-1006 is an authentication bypass vulnerability affecting Microsoft Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF). This flaw allows an attacker to sign SAML tokens using arbitrary symmetric keys, potentially granting unauthorized access. With a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity, leading to high integrity impact without requiring user interaction. While not listed in CISA's KEV catalog and lacking public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness despite no confirmed active exploitation.