Kerberos
A ticket-based network authentication protocol using symmetric cryptography and a trusted third party, the Key Distribution Center. A client authenticates once, receives a ticket-granting ticket, and exchanges it for short-lived service tickets without resending credentials. Version 5 is specified in RFC 4120.
Kerberos descends from the Needham-Schroeder protocol of 1978 and was built at MIT's Project Athena. It is the primary authentication protocol in Active Directory, which makes it one of the most widely used pieces of security software in existence. Its design, authenticate once then present short-lived tickets, is the same shape as every token-based system that followed, including OAuth. It also means the ticket handling is the attack surface: tickets that can be requested offline and cracked, service accounts with weak passwords, and delegation settings that let one compromise reach further than intended.
See also: Active Directory, Kerberoasting, Kerberos delegation abuse, Clifford Neuman, SSO
Related on Start with Identity
- GlossaryLDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit
- GlossarySAML 2.0
Security Assertion Markup Language. An XML-based protocol for federated authentication, dominant in enterprise SSO. Largely superseded by OIDC for new deploymen
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- CVEFortiWeb FortiCloud SSO SAML bypass
The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or d