CVE-2024-22245: Arbitrary Authentication Relay Vulnerability in Deprecated EAP Browser Plugin

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-20 · updated 2026-06-17
Weakness: CWE-287

Description

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

Affected products

VMware Enhanced Authentication Plugin: before 6.7.0 — fixed in 6.7.0
VMware Enhanced Authentication Plug-in (EAP): all versions

How to fix

Upgrade to a fixed version: VMware Enhanced Authentication Plugin 6.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-22245 or the next vulnerability affects your stack