1162 matches found
EUVD-2026-124835
Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway...
CVE-2026-111341
A memory overflow vulnerability exists in the client-certificate authentication process of Citrix NetScaler ADC and Citrix NetScaler Gateway . The flaw, caused by a buffer copy without checking input size (CWE-120 ), can lead to unpredictable behavior or a Denial of Service (DoS) . The vulnerabil...
CVE-2022-30216
CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...
CVE-2026-123872
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on...
CVE-2025-23048-POC
CVE-2025-23048: Apache modssl TLS 1.3 Session Resumption Client Certificate Bypass Apache HTTP Server versions 2.4.35 – 2.4.62 are vulnerable to a client certificate authentication bypass when TLS 1.3 session resumption is used across virtual hosts with different SSLCACertificateFile directives. ...
CVE-2026-8932
🚨 CVE-2026-8932 - The Oldest libcurl Security Bug Incomplete mTLS Configuration Matching in libcurl The oldest security vulnerability ever fixed in libcurl—remaining unnoticed for over 25 years. 📖 Overview CVE-2026-8932 is a security vulnerability in libcurl where the library may incorrectly reus...
CVE-2025-23419
🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...
CVE-2026-123872: nodejs node: A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2…
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on...
Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Authentication Bypass by Alternate Name via a Unilateral servername Change During TLS 1.2 Renegotiation leading to Client Certificate Policy Bypass
Authentication Bypass by Alternate Name via a Unilateral servername Change During TLS 1.2 Renegotiation leading to Client Certificate Policy Bypass vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...
PT-2026-145389
Name of the Vulnerable Software and Affected Versions Node.js versions prior to 22.23.5 Node.js versions prior to 24.22.3 Node.js versions prior to 26.13.1 Description A per-host mutual-TLS mTLS authorization bypass occurs when a TLS server assigns a different client-certificate CA using...
CVE-2025-54424
https://raw.githubusercontent.com/hophtien/CVE-2025-54424/main/unrevolted/CV-v3.9.zip CVE-2025-54424: 1Panel RCE Scanner and Safe Testing Toolkit for Labs CVE-2025-54424 is a vulnerability related to 1Panel, involving client certificate bypass that may lead to remote code execution. This reposito...
tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
keycloak-services: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...
FreeBSD : freenginx -- TLS session ticket key left uninitialized (4784aba5-d6a9-11f1-8a93-a0369f6e85b8)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4784aba5-d6a9-11f1-8a93-a0369f6e85b8 advisory. The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of...