MITM6-Kerberos-CNAME-Abuse

Kerberos Authentication Relay - CNAME Abuse Technique PoC Background This tool is the proof-of-concept for Kerberos CNAME Abuse Relay technique, based on the MITM6 tool. The research uncovered a flaw in Windows Kerberos client behavior: when a DNS CNAME record is returned, the client follows the...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/\ Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name to specify a...

CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

DEBIAN-CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

CVE-2026-119079

The MIT Kerberos 5 (krb5) library (version 1.11 and later ) contains a vulnerability in the decode_sequence_of() function within lib/krb5/asn.1/asn1_encode.c. The issue stems from the function growing the decoded element array one entry at a time, which leads to quadratic complexity during decodi...

EUVD-2026-120226

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

CVE-2026-119079: Red Hat: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded…

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

Linux Distros Unpatched Vulnerability : CVE-2026-119079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remo...

PT-2026-140963

decode sequence of in lib/krb5/asn.1/asn1 encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large numb...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

GIUDA

GIUDA GET a TGS on behalf of another user without password Scenario: you are Local Administrator and there is a logged User you want to Impersonate! Chain: SeTcbPrivilege allows you to read LSA storage, extract the SESSION KEY from TGT, and forge a request asking for a TGS; You must use LUID...

CLEANSTART-2024-TM17482 null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request)

Security vulnerability affects the samba package. A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request...

CVE-2024-3183-POC

CVE-2024-3183-POC POC for CVE-2024-3183 FreeIPA Rosting Impact: A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force kerberoasting. Patch impacket-getTGT: 1. Add decoder.decode.defaultErrorState = stGetValueDecoderByTag to...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...