CVE-2024-22245: VMware Enhanced Authentication Plugin

Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days.

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

Affected products

• VMware Enhanced Authentication Plugin: before 6.7.0 (fixed in 6.7.0)
• VMware VMware Enhanced Authentication Plug-In Eap: any version

Published 2024-02-20. Last modified 2026-06-17.