Identity CVEs

The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched October 29, CISA KEV on October 30, 2026.

An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, and promote itself to Jump Item administrator. CVSS 9.3, exploited from August 2026, CISA KEV on October 16.

CVE-2026-89111 lets anyone who controls the tenant subdomain in a multi-tenant SAP BTP application redirect the SDK's OAuth2 token request, along with the app's client ID and secret. CVSS 10.0, fixed in sap-cloud-sdk 0.45.2.

One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 2026, added to CISA KEV on October 13. CVSS 8.6, fixed in 22.8R2.5 and 25.1.3.0.

CVE-2026-107406 is a memory overflow in NetScaler ADC and Gateway that can lead to remote code execution when the appliance acts as a SAML identity provider or service provider. CVSS 9.5, fixed in 14.1-73.46 and 13.1-64.29.

CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway reachable only when the appliance acts as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV, CVSS 8.7, fixed in 14.1-73.41 and 13.1-64.28.

A session hijack flaw in Zammad 6.3.0 to 6.5.4 gave attackers code execution as the zammad user. It was exploited against DIVD before disclosure. CISA KEV on October 2, 2026.

BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploited, CISA KEV on September 22, 2026.

An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root. CVSS 10.0, exploited, CISA KEV on September 16, 2026.

Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9, exploited from September 12, CISA KEV on September 22, 2026.

ScreenConnect clients before 26.6.5 could let files be pushed and run through an active session without authorization or host confirmation, including with elevated execution. CISA KEV on September 11, 2026.

Any authenticated FreeIPA principal could push --organization or --base-url values into an eval() call that ran before the access check, reading the server process environment and exhausting memory. Containers that pass admin passwords by environment variable are most exposed. Fixed in FreeIPA 4.13.4.

FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI flaw produced an attacker-owned Kerberos principal in the admins group. Fixed in FreeIPA 4.13.4.

CVE-2026-19490 lets an attacker bypass authentication on NetScaler ADC and Gateway appliances running a Gateway or AAA virtual server. CVSS 9.3, shipped alongside a memory overflow. Fixed in 14.1-73.32 and 13.1-63.21.

Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no email verification token required. Any account, including admins. CVSS 9.1, fixed in 26.7.2.

Self-hosted Artifactory could return an internal anonymous-user token to an unauthenticated request even with anonymous access disabled. Attackers chained it with CVE-2026-42016 to reach an admin-scoped token. CISA KEV on September 11, 2026.

A state-management bug in macOS Screen Sharing let an attacker on the network authenticate without a valid password and take remote control of the Mac. Apple fixed it on August 6, 2026; CISA KEV on August 18, 2026.

Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML train with CVE-2026-2603.

N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August 2026.

An alternate-path authentication bypass in N-able N-central gave attackers remote admin access without a login. Exploitation was detected on July 31, 2026 and the first hotfix was incomplete (CVE-2026-18577). CISA KEV on August 4, 2026.

Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 July 2026. The third TeamCity auth-bypass in this catalog.

Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin actions. Chained with CVE-2026-42018 in the wild. CISA KEV on September 11, 2026.

A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a full administrator. Exploited against a handful of internet-exposed servers. CISA KEV on July 22, 2026.

A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation before the July 14, 2026 patch, and CISA added it to KEV the same day.

Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026 and exploitation followed within days. CVSS 9.1, patched in July 2026.

The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black Hat USA 2026 as Pass-the-Passkey against Entra ID. Patched July 2026.

LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object when key validation failed, so a fabricated Authorization header reached the gateway's MCP tools. Honeypots saw single-character tokens used in the wild. CISA KEV on September 2, 2026.

A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid password. Exploited from May 7, 2026, with a Qilin ransomware link. CISA KEV on June 8, 2026.

GlobalProtect portals and gateways with authentication override cookies enabled could be tricked into opening a VPN session without a login or MFA. Qilin and INC ransomware operators used it. CISA KEV on May 29, 2026.

SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch is out and a public PoC exists.

WSO2 API Manager and related gateways validated JWTs signed with algorithms they were never configured to accept, allowing account takeover including admins. CVSS 10.0, advisory May 2026, CISA KEV September 24, 2026.

Kerberos Change Password (kpasswd) did not honor PAC_REQUESTOR_SID the way the rest of AD did. A low-privilege user who can write their UPN can reset a Domain Admin password. Microsoft rated it Important. Patched April 2026.

IdentityIQ failed to authorize role edits on all versions at disclosure (April 2026). Anyone who could reach the role-editing surface could change roles they should not.

With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped runner memory and swept cloud keys. CISA KEV on March 26, 2026.

A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a control you thought you turned off.

A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's written standard is optional.

Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March 2026.

Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. Semperis / Shai Laron. CVSS 8.8. Patched March 2026.

A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerberos year.

An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 let an unauthenticated remote attacker read specific stored credential data. Patched February 10, 2026 with no known exploitation; CISA KEV on March 9, 2026.

An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning began the day after a public exploit. CISA KEV on February 13, 2026, with known ransomware use.

An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-288, CVSS 9.8, exploited, CISA KEV on January 27, 2026.

SmarterMail accepted authentication on an alternate path. CISA KEV, January 2026. Mail-admin planes keep failing the 'we protected the primary URL' test.

Domain controllers issued RC4-encrypted service tickets to accounts with no explicit encryption setting, which an attacker can crack offline for the service account password. Microsoft's fix moves the KDC default to AES-SHA1, enforced from April 2026 and mandatory from July 2026.

The Okta Java SDK could attach another request's response to yours (CWE-362). CVSS 8.4. Patched in v20.0.1, December 2025. Token mix-up in the official SDK.

The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or disable SSO' advice.

A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025 with a 23 December patch-by date.

Companion to CVE-2025-66567. Another SAML bypass in ruby-saml below 1.18.0, including 1.12.4. Same December 2025 disclosure, same 1.18.1 fix.

Disclosed 8 December 2025 with CVE-2025-66568. ruby-saml below 1.18.0, including the earlier patched 1.12.4 line, still allowed SAML assertion forgery. Fixed in 1.18.1.

node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature bypass in the library under Auth0 and a long tail of Node verifiers.

Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-managed access.

Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.

FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the December FortiCloud SSO wave.

The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented at Black Hat EU, December 2025. Silverfort named it CheckSum.

IdentityIQ reflected script through an incorrect content-type (CWE-79). CVSS 7.1. November 2025. An XSS on an IGA console is an admin-session theft.

Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.

Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch train as the 2025 Kerberos work.

October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.

Keycloak could be knocked over by TLS 1.2 renegotiation. Availability of the IdP is an identity incident. Not an auth bypass.

Undocumented Actor tokens plus an Azure AD Graph tenant-validation flaw let an attacker impersonate any user, including Global Admin, in every Entra ID tenant. No MFA, no Conditional Access, no useful logs.

The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.

Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key impersonates the entity. CVSS 6.8.

Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in CVE-2025-6013.

Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.

A timing side-channel in Vault auth let an attacker tell valid usernames from invalid ones. Confirm CVSS against NVD.

Vault treated Userpass and LDAP usernames as case-sensitive for lockout and case-insensitive for login. Case permutation resets the lockout counter and enables mass brute force. CVSS 5.3.

Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Vault 1.20.2 and the matching Enterprise trains.

Vault normalized policy names in a way that let a lower-privilege token become root. CVSS 7.2. Part of the August 2025 VaultFault set.

The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you stopped at 1.12.4.

OAuth2-Proxy's skip_auth_routes regex ran against the full URI, including query parameters. A crafted query string could skip authentication on a protected path. CVSS 9.1.

An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped automatically in v1.84.0. A syntax error kept it from running. Fixed in 1.85.0.

A second Conjur IAM-authenticator bypass, this time through a misconfigured network device. CVSS 9.1. Same Cyata chain as CVE-2025-49827.

Conjur allowed a path traversal that disclosed files from the host. CVSS 7.1. Useful in the Cyata chain for reading configuration and secrets material after an authenticator bypass.

Conjur skipped validations that should have blocked a resource injection and permission bypass. CVSS 6.0. The lowest score in the Cyata set, and still part of the unauthenticated RCE chain.

Conjur rendered a template in Ruby without isolating attacker input. CVSS 8.6. In the Cyata chain this is the step after the IAM authenticator bypass: from forged identity to code execution.

Conjur's AWS IAM authenticator could be pointed at an attacker-controlled STS by a malformed regex (CWE-807). CVSS 9.1. One of five Cyata findings, chainable to unauthenticated RCE. Black Hat USA 2025.

Keycloak's First Broker Login had a time-of-check/time-of-use gap. A phishing or race could merge an attacker's IdP account onto a victim. CVSS 3.1 on paper. The identity lesson is larger than the score.

An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.

Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.

samlify before 2.10.0 accepted wrapped SAML signatures (CWE-347). An attacker can forge responses and impersonate any user, including admins. Node shops hit this as hard as Ruby shops hit ruby-saml.

The Windows KDC did not validate certificate-based logon (PKINIT) against NTAuth the way defenders thought. Remote elevation of privilege. Patched April 2025, with NTAuth enforcement changes you have to opt into correctly.

Quest KACE Systems Management Appliance improper authentication. On CISA KEV. A management appliance with a broken login is a fleet-wide identity incident.

Zitadel's JWT authorization grant did not check whether the client key had expired. A retired key kept working. Patched by the project.

An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs. CISA KEV on March 18, 2025.

A compressed SAML message can be inflated into a resource-exhaustion hit against ruby-saml. Not an impersonation bug, but it sits in the same March 2025 patch train as the critical wrapping flaws.

The pair to CVE-2025-25291. A second signature-wrapping path in ruby-saml lets an attacker forge assertions and impersonate any user. The March 2025 patch was later shown to be incomplete.

ReXML and Nokogiri disagree on the same SAML document. An attacker with one valid signature can wrap a new assertion and log in as any user on GitLab, omniauth-saml, and anything else still on ruby-saml before 1.12.4 / 1.18.0.

A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted by another. Disclosed by the OpenID Foundation with CVE-2025-27370.

The OpenID Connect twin of CVE-2025-27371. private_key_jwt audience is ambiguous at the spec layer, so a client assertion can be replayed across authorization servers.

A PingFederate CVE from 2025. NVD detail was thin at the time of this brief. Treat it as a PingFederate security update you should already have taken, and confirm the vendor advisory for the exact build.

An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets customers' Microsoft 365 backup apps used. CISA KEV on April 28, 2025.

StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High. Patched by StrongKey.

A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still someone else's access token.

PingAM Java Policy Agent allowed relative path traversal and parameter injection. CNA CVSS-B 9.2. February 2025. A policy-agent bug is an authz bypass in front of every app it protects.

Keycloak did not re-check Active Directory on password reset. An expired or disabled AD account could regain access through Keycloak's reset flow.

GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity SSO impersonation on self-hosted GitHub.

A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S4U and PKINIT failures.

Missing backend authorization checks in SimpleHelp 5.5.7 and earlier let a low-privilege technician make API keys with admin rights and take over the remote support server. Storm-1175 exploited it. CISA KEV on April 24, 2026, with known ransomware use.

Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM control-plane bug, not a random RCE.

IdentityIQ exposed protected static content through improper access control and directory traversal. CVSS 10.0. Disclosed December 2024. e-fixes for 8.2p8, 8.3p5, 8.4p2. Still in every 2025 IGA review.

A crafted LDAP response crashes the Windows LDAP client and can take a domain controller down. SafeBreach published a PoC in January 2025. High. Patched December 2024. Pair with CVE-2024-49112.

The critical sibling of LDAPNightmare. CVSS 9.8. Patched with CVE-2024-49113 in December 2024. If you only took the DoS patch, check the build.

AD CS V1 templates let Application Policy override EKU in a way that issues certificates with unintended enhanced key usages. High. Patched November 2024, still widely unpatched in 2025-2026 assessments.

The leftover path after CVE-2024-4985. Encrypted SAML assertions on GHES could still be forged. GitHub shipped a second hardening pass. Treat 4985 and 9487 as one upgrade.

Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on any realm using SAML. High. Red Hat patched September 2024.

The original 2024 ruby-saml authentication bypass (CVSS 10.0). It is outside the last twelve months, but every 2025 ruby-saml CVE is an incomplete-fix descendant. If you are still on a pre-2024 library, start here.

A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do not trust encrypted assertions to save a wrapping bug.

Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastPass phishing research and the 52-character DelAuth advisory, which did not get a CVE.

A chosen-prefix MD5 collision on the RADIUS Response Authenticator lets a man-in-the-middle forge Access-Accept, bypass MFA, and escalate when CHAP/PAP run without Message-Authenticator. Protocol-wide. Vendors were still shipping patches into 2026.

HaloITSM accepted a wrapped SAML assertion. An attacker with one valid signature could impersonate any user, including admins. Critical. Another 2024 reminder that ITSM tools are identity providers in practice.

An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosure is an identity incident on a VPN concentrator.

Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The protocol-level cousin of private_key_jwt audience mix-ups.

GHES with optional encrypted SAML assertions accepted a forged response. An unauthenticated attacker could provision a site administrator. Fixed in 3.9.15, 3.10.12, 3.11.10, and 3.12.4. The leftover path became CVE-2024-9487.

Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Patched in the April 2024 Keycloak train, assigned 2023.

The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2024 Keycloak train.

Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-2023-6787 and CVE-2023-6717.

Identity Security Cloud transform templates could be turned into remote code execution. Same class as Conjur's Ruby template injection, on the SaaS IGA side.

Identity Security Cloud connector configuration allowed path traversal. The 2025-2026 research notes that SCIM itself was quiet; provisioning risk sat in IdP and IGA connectors instead.

Identity Security Cloud (ISC) failed an access-control check. One of three 2024 ISC CVEs (3317/3318/3319) that still shape how we talk about SaaS IGA risk in 2025-2026.

The forest-trust sibling of CVE-2024-26248. PAC validation could be skipped across a trust. Same April 2024 patch train, same staged enforcement.

A process could spoof the PAC signature and skip the CVE-2022-37967 checks Microsoft added in KB5020805. April 2024. Enforcement is staged: both DCs and clients must be updated or Kerberos can break.

Unauthenticated attacker becomes a TeamCity administrator on on-prem instances. CVSS 9.8. Widely exploited. CISA KEV. The 2024 sequel to CVE-2023-42793, and the reason the 2026 agent-polling bypass was treated as urgent.

ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. Pair with CVE-2024-1708 (path traversal) for the RCE chain.

SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CISA KEV. The SAML ACS became the way back in.

Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclosure of a 2023 bug. The VPN login was optional.

An unauthenticated machine-in-the-middle can impersonate a Windows Kerberos server. CVSS 8.8. January 2024 Patch Tuesday. The 2024 opening shot in a two-year Kerberos year.

A buffer over-read on NetScaler ADC/Gateway leaked session tokens in the clear. Attackers replayed them and skipped the login, including MFA. CISA KEV. October 2023. The textbook session-hijacking CVE.

Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors. The 2023 original of a three-year TeamCity pattern.

Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the matching Enterprise trains.

Ivanti Sentry (MobileIron Sentry) skipped authentication on an administrative API. CISA KEV. August 2023. The gateway in front of EPMM had its own unlocked door.

Every supported EPMM 11.8-11.10 release exposed restricted API functionality with no login. Attackers pulled user and device data, then chained CVE-2023-35081. CISA KEV. July 2023. MDM is an identity control plane.

SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9.8. CISA KEV. Chained with CVE-2023-24955 for RCE.

PaperCut NG/MF improper authentication. A 2023 CVE that remains on CISA KEV and in 2025-2026 ransomware playbooks. Print-management appliances keep getting treated as low-value. They are not.

The critical sibling of CVE-2023-27351. Unauthenticated setup path plus built-in scripting became RCE. CISA KEV. Used by ransomware in April-May 2023. Print servers hold AD bind accounts.

Strapi let API callers filter users on private fields and read the answer out of the response, leaking password hashes and password reset tokens. Fixed in 4.8.0 in 2023, added to CISA KEV on October 8, 2026.

A crafted Outlook appointment set PidLidReminderFileParameter to an attacker UNC path. The client leaked NTLM hashes when the reminder fired. No user click. CISA KEV. March 2023. Credential theft as a calendar invite.

The 2022 AD CS cert-based privilege escalation, still observed in incident response in 2025 (Rapid7, Unit 42). CVSS 8.8. The durable control is strong certificate mapping (KB5014754), not only the original patch.