freeipa

FreeIPA Server FreeIPA allows Linux administrators to centrally manage identity, authentication and access control aspects of Linux and UNIX systems by providing simple to install and use command line and web based management tools. FreeIPA is built on top of well known Open Source components and...

noPac

noPac This project originated from studying the principle of noPac, with some modifications based on the cube0x0 project. Personal understanding comments have been added to the source code. Removed the Scan functionality, as I found it to be of limited use. Added a check for the MachineAccountQuo...

orpheus

Orpheus Orpheus is a wrapper for a modified version of Impacket's GetUserSPNs.py and kerberosv5.py which alters the KDC Options Ticket Options and the Encryption Type for Kerberoasting. Side Note: Orpheus is named after the Greek god that was able to get past Cerberus the three headed dog to get...

RLSA-2026:99624 Important: krb5 security, bug fix, and enhancement update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

RLSA-2026:99715 Important: krb5 security, bug fix, and enhancement update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass CVSS Score: 9.8 Critical Status: Active exploitation in the wild Disclosure: Microsoft August 2025 Patch Tuesday Zero-Day Overview CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protoc...

cve-2026-20833-rc4-kerberos

CVE-2026-20833 — Kerberos RC4 Hardening This repository consolidates technical documentation , PowerShell scripts , Power BI dashboards , and official Microsoft references related to the progressive deprecation of RC4 in Kerberos for Active Directory environments , as part of Microsoft's security...

RockyLinux 10 : krb5 (RLSA-2026:99624)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99624 advisory. krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTHGSSAPIINIT requests CVE-2026-112323 krb5: MIT krb5 kadmind unauthenticated CPU...

RockyLinux 9 : krb5 (RLSA-2026:99715)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99715 advisory. krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTHGSSAPIINIT requests CVE-2026-112323 krb5: MIT krb5 kadmind unauthenticated CPU D...

krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun

In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate...

Important: Red Hat Security Advisory: krb5 security, bug fix, and enhancement update

An update for krb5 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...

krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path

krb5ktkdbgetentry in lib/kdb/keytab.c in MIT Kerberos 5 aka krb5 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service memory leak in the KDC or kadmind via requests that repeatedly trigger key decryptio...

krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun

In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate...

krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...

krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path

krb5ktkdbgetentry in lib/kdb/keytab.c in MIT Kerberos 5 aka krb5 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service memory leak in the KDC or kadmind via requests that repeatedly trigger key decryptio...

Important: Red Hat Security Advisory: krb5 security, bug fix, and enhancement update

An update for krb5 is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...