RiskySPN

RiskySPNs RiskySPNsは、SPN Service Principal Name に関連付けられたアカウントを検出および悪用することに焦点を当てたPowerShellスクリプトのコレクションです。このモジュールは、ブルーチームが潜在的に危険なSPNを特定するのに役立つ一方、レッドチームがKerberosとActive Directoryを活用して権限を昇格させるのにも役立ちます。 詳細情報：http://www.cyberark.com/blog/service-accounts-weakest-link-chain/ 使用方法 モジュールのインストール...

kerberoast

kerberoast Kerberoastは、MS Kerberos実装を攻撃するための一連のツールです。以下は各ツールの機能の簡単な概要です。 組み込みのMSツールを使用してSPNとして使用中のすべてのアカウントを抽出する PS C:\ setspn -T medin -Q / チケットを要求する 1枚のチケット: PS C:\ Add-Type -AssemblyName System.IdentityModel PS C:\ New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2026-35414

CVE-2026-35414 CVE-2026-35414 漏洞代码块 auth2-pubkeyfile.c（存在漏洞） static int matchprincipalsoptionconst char principallist, struct sshkeycert cert char result; uint i; / XXX percentexpand sequences for authorizedprincipals? / for i = 0; i nprincipals; i++ if result = matchlistcert-principalsi,...

CVE-2026-29000-pac4j-jwt-auth-bypass

HTB Principal — CVE-2026-29000 漏洞分析报告 免责声明： 此漏洞利用程序仅为已退役的 HackTheBox 机器 "Principal" 开发。仅供教育目的使用。请勿将其用于您不拥有或未经明确许可测试的系统。 机器信息 字段| 详情 ---|--- 名称| Principal 平台| HackTheBox 难度| — 状态| 已退役 漏洞 — CVE-2026-29000 受影响的库： pac4j-jwt 5. 获得未授权访问权限 🛠️ PoC 使用方法 安装依赖 pip install jwcrypto requests 运行漏洞利用程...

ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CVE-2026-100684

Budibase versions 3.41.0 before 3.45.0 are vulnerable to an authentication bypass in the @budibase/server OIDC/SSO login path. The flaw exists in sso.authenticate because the server identifies pending user invites using only the IdP-asserted email address without validating an invite code or chec...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in JWTRefreshMiddleware's caller resolution, which resolves the caller from the session cookie and ignores an accompanying Authorization: Bearer token, inverting the intended precedence of bearer over cookie. An...

PYSEC-2026-3989

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355

Apache Airflow versions 3.3.0 and 3.3.1 are vulnerable to an Incorrect Authorization issue where the system prioritizes a session cookie over an explicit Authorization: Bearer token. This inversion of precedence allows an attacker who successfully plants a session cookie—via cookie tossing , cros...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

PT-2026-96120

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.3.0 through 3.3.1 Description An issue exists in the Airflow core API where the system incorrectly prioritizes a session cookie over an explicit Authorization: Bearer token when both are present in a request. This...

Exploit for CVE-2026-75157

CVE-2026-75157 PoC Authorized security research PoC for the A...

CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...

Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...

CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...