EIP-2026-103960

This is a technical writeup describing a vulnerability in Kerberos authentication where the login service fails to verify the KDC's authenticity if the service is not registered as a principal or lacks a secret key. An attacker can spoof KDC responses to illicitly log into the server.