Token Replay detection was not properly implemented in the migration to .Net Core. The security implications are described in: https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv and published as CVE-2020-5261