CVE-2016-1000238

Affected versions of "node-krb5" do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials...

WS-2016-0052

"Node-krb5 is a node.js native add-on for simple krb5 user authentication.This module does not validate the KDC, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials."...

Spoofing attack due to unvalidated KDC in node-krb5

Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...

lets-chat-kerberos (>=0.2.0, <=0.4.1), passport-assistant-kerberos (0.0.1) +1 more potentially affected by CVE-2016-1000238 via node-krb5 (0.0.6)

node-krb5 NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on node-krb5 and may be impacted: - lets-chat-kerberos =0.2.0, =0.4.1 - passport-assistant-kerberos 0.0.1 - passport-kerberos 0.0.1 Source cves: CVE-2016-1000238 Source advisory:...

GHSA-4V9Q-HM2P-68C4 Spoofing attack due to unvalidated KDC in node-krb5

Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...

PT-2020-7943

Name of the Vulnerable Software and Affected Versions: node-krb5 affected versions not specified Description: The issue concerns the lack of validation of the KDC prior to authentication in affected versions, potentially allowing an attacker with network access to spoof the KDC and impersonate a...