PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

mssqlbof

mssqlbof A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself, in C. No msodbcsql.dll, no sqloledb.dll, no .NET CLR, no PowerShell. One COFF per arch, loads into every beacon that honors the canonical Beacon API. Why SQL Server shows up on nearly every...

Curl 8.21.0 < 8.23.0 Multiple Connection Reuse Vulnerabilities

The version of curl installed on the remote host is 8.21.0 prior to 8.23.0. It is, therefore, affected by multiple connection reuse vulnerabilities: - libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel...

curl: CVE-2026-115529: Schannel TLS auto client session resumption

Summary: In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled. This appears to be an incomplete fix for CVE-2026-86415, where the original fix...

ALPINE-CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

A flaw in libcurl builds configured with the Microsoft Schannel TLS backend allows for an auto client cert connection reuse mixup . The connection cache match function fails to evaluate client certificate authentication settings during HTTP redirects. This enables a malicious server to redirect a...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

EUVD-2026-105307

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415 auto client cert connection reuse mixup

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

curl information leakage vulnerability

Curl versions 8.21.0 and earlier, as well as 8.22.0 and earlier, have a vulnerability related to information leakage. This vulnerability arises from the connection caching matching function not considering the automatic client certificate option. As a result, authenticated Schannel connections ma...

CVE-2026-86415

A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security TLS backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in builds configured with the Microsoft Schannel TLS backend, the connection cache fails to properly evaluate client certificate authentication settings during HTTP redirects. An attacke...

DEBIAN-CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CURL-CVE-2026-86415 auto client cert connection reuse mixup

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

auto client cert connection reuse mixup

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache matcher never considers the automatic client certficate option, so a cached, already authenticated Schannel connection can be handed to a transfer that just got redirected to a different origin, even though the code explicitly switched off the auto client cert option fo...

PT-2026-113743

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description The connection cache match function fails to consider the automatic client certificate option. This allows a cached Schannel connection that was already authenticated to be reused for a...