PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

CVE-2022-26923-rayng

Exploiting CVE-2022-26923: Certificate Authority Privilege Escalation Overview CVE-2022-26923 is a vulnerability in Active Directory Certificate Services AD CS that allows an attacker to escalate privileges by misusing certificate-based authentication. This guide outlines the steps to exploit thi...

watchTowr-vs-Check-Point-CVE-2026-50751

CVE-2026-50751 A Check Point Remote Access VPN IKEv1 certificate-authentication bypass Detection Artefact Generator. https://github.com/user-attachments/assets/1280c545-364e-42d1-94ac-5b2cd850d14e See our blog post for technical details. Detection in Action $ python3...

Invoke-RunAsWithCert

Invoke-RunAsWithCert A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. Description This cmdlet creates a new logon session with the specified certificate via PKINIT. It is meant to be run on a non domain-joined VM. The cmdlet has two modes...

EUVD-2026-124835

Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway...

CVE-2026-111341

A memory overflow vulnerability exists in the client-certificate authentication process of Citrix NetScaler ADC and Citrix NetScaler Gateway . The flaw, caused by a buffer copy without checking input size (CWE-120 ), can lead to unpredictable behavior or a Denial of Service (DoS) . The vulnerabil...

CVE-2024-49019-rayng

Exploiting CVE-2024-49019: Certificate Authority Privilege Escalation Overview CVE-2024-49019 is a vulnerability in Active Directory Certificate Services AD CS that allows an attacker to escalate privileges by misusing certificate-based authentication. This guide demonstrates how to exploit this...

CVE-2026-123872

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

ROS-20261110-73-0119

A vulnerability in Netty related to errors in the certificate authentication process. Exploitation of this vulnerability can be carried out remotely...

CVE-2026-123552

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

EUVD-2026-119437

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150491 advisory. Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...

tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...

Eclipse ioFog Operator Platform Bypass Security

The software vulnerability related to the Eclipse ioFog Operator platform management system stems from errors in the certificate authentication process. Exploitation of this vulnerability could enable a remote attacker to bypass existing security mechanisms...

CLEANSTART-2026-LU55702 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

Security vulnerability affects the ingress-nginx-controller package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers...

BIT-NODE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...

PT-2026-135878

Уязвимость программного обеспечения для управления платформой Eclipse ioFog Operator связана с ошибками процедуры подтверждения подлинности сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие механизмы безопасности...

DEBIAN-CVE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...