PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

mssqlbof

mssqlbof A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself, in C. No msodbcsql.dll, no sqloledb.dll, no .NET CLR, no PowerShell. One COFF per arch, loads into every beacon that honors the canonical Beacon API. Why SQL Server shows up on nearly every...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

A flaw in libcurl builds configured with the Microsoft Schannel TLS backend allows for an auto client cert connection reuse mixup . The connection cache match function fails to evaluate client certificate authentication settings during HTTP redirects. This enables a malicious server to redirect a...

EUVD-2026-105307

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security TLS backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different...

auto client cert connection reuse mixup

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CURL-CVE-2026-86415 auto client cert connection reuse mixup

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache matcher never considers the automatic client certficate option, so a cached, already authenticated Schannel connection can be handed to a transfer that just got redirected to a different origin, even though the code explicitly switched off the auto client cert option fo...

PT-2026-113743

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description The connection cache match function fails to consider the automatic client certificate option. This allows a cached Schannel connection that was already authenticated to be reused for a...

CVE-2026-85818

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-70566

Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally...

CVE-2026-105008

No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-105005

Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network...

CVE-2026-105008

A vulnerability in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. This issue can lead to an attacker acting as another user with a CVSSv3.1 score of 9.0 (CRITICAL) . Exploitation requires high complexity and no prior authentication or user interaction. System...

CVE-2026-105005

An out-of-bounds write vulnerability exists in Windows Schannel , which could allow an unauthorized attacker to execute code over a network . The vulnerability is associated with CWE-787 and has a CVSS v3.1 base score of 8.1 (High) . While the documents confirm the impact and root cause type, spe...

CVE-2026-85818

A critical vulnerability exists in Windows Schannel due to the improper verification of cryptographic signatures . This flaw allows an unauthorized attacker to perform spoofing over a network . The vulnerability has a CVSS v3.1 base score of 9.0 , resulting in high impacts on confidentiality, int...