EUVD-2026-94318

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

OutOfTune

OutOfTune 受原始 Pytune 启发，OutOfTune 在 Entra ID 中注册一个恶意设备，将其注册到 Intune MDM，并检查最终的合规状态。 目前仅支持 Windows 设备（这是我的主要目标），未来可能会添加其他平台。 配套博客： https://stra-x.github.io/Re-Engineering-Pytune-Rogue-devices-in-the-age-of-conditional-access/...

Certi-Bhai

Certi-Bhai：AD CS 利用工具包 Certi-Bhai 是一个全面的 PowerShell 利用工具集合，用于攻击 Active Directory 证书服务（AD CS）漏洞。该工具包实现了多种提权场景（ESC），展示了 ADCS 环境中严重的安全配置错误。 📋 目录 概述 目录结构 前提条件 使用指南 ESC1 - 权限过宽的证书模板 ESC2/3 - 证书请求代理 ESC15 - 易受攻击的 Web 注册 CSR 生成 IIS 权限提升 🎯 概述 Active Directory 证书服务（AD CS）经常被错误配置，从而产生多种攻击向量。Certi-Bhai...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory 证书服务 AD CS 权限提升 👋 概述 CVE-2026-54121（"Certighost"） 是一个影响 Microsoft Active Directory 证书服务（AD CS） 的高危权限提升漏洞。 该漏洞允许已认证的域用户滥用证书注册行为，获取能够模拟 域控制器 的证书，从而可能导致 整个 Active Directory 环境被攻陷 。 ⚠️ 本仓库 仅用于 授权的安全研究、检测工程和防御性测试。 ✨ 功能特性 📖 技术漏洞说明 🔍 检测指南 🛡️ 缓解建议 🧪 入侵指标（IoCs）...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105209

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105212

ZITADEL versions prior to 3.4.14 and 4.16.2 are vulnerable to an authentication bypass in the hosted Login V1 and Login V2 UIs. The root cause is the system's acceptance of passkey or other authenticator enrollments during identify-only login sessions before a primary factor is verified. This all...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

EUVD-2026-92102

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105209

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to an improper authorization flaw (CWE-862) during passkey or passwordless enrollment. The system incorrectly validates the organization ID provided in the x-zitadel-orgid header instead of verifying the target user's actual ...

EUVD-2026-92103

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to a missing authentication flaw in the hosted Login V1 UI . The root cause is that second-factor enrollment and initialization handlers process requests on an identify-only session before the primary factor is verified. An a...

virt-firmware

OVMF / armvirt 固件卷的工具 这是一个用于 edk2 固件镜像的小型工具集合。它们支持解码和打印固件卷的内容。变量存储（OVMFVARS.fd）可以被修改，例如用于注册安全启动证书。 virt-fw-dump 解码并打印固件卷的内容。 用法：virt-fw-dump -i 。 更多信息请尝试 virt-fw-dump --help，包含一些用于过滤输出的选项。 virt-fw-vars 打印和编辑变量存储卷。 目前专注于注册证书和启用安全启动。 打印变量：virt-fw-vars -i --print。 注册证书： virt-fw-vars \ --input ...

PT-2026-104636

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...