A Millisecond of Predictability Why CVE-2026-11374 Is Hard t...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit
• Blog Title: A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
• Suggested Section: Pentesting Web > Account Takeover, with a new subsection such as Predictable SSO/Bearer Tokens and Two-Stage Authentication Replay; cross-reference Cookies Hacking and Rate Limit Bypass

🎯 Content Summary

Overview and impact

CVE-2026-11374 is a critical unauthenticated account-takeover vulnerability affecting the cross-product SSO implementation used by four ManageEngine products when integrated with AD360. The affected and fixed builds are:

• ADSelfService Plus: affected ≤ 6528; fixed in 6529.
• RecoveryManager Plus: affected ≤ 6320; fixed in 6321.
• M365 Manager Plus: affected ≤ ...

  🔧 Technical Details

  Predictable timestamp bearer tokens: When an authentication or SSO implementation uses System.currentTimeMillis() directly as both the client-visible token and server-side cache key, the token has no secret entropy. Estimate the victim's login window, convert that interval into candidate millisecond values, and test each value through the normal token-resolution path. A one-second window yields about 1,000 candidates and a one-minute window about 60,000. Review product-specific overrides even when the framework's base generator safely uses UUIDs or another cryptographically random value.

  Cross-application branch manipulation: Some cookie-SSO handlers resolve tickets only when a cookie claims the ticket originated from another integrated application. Supplying a different application tag can satisfy an appName != prodName-style condition and force execution into the cross-product resolver. In this case, a protected 🤖 Agent Actions

  Done.

  Updated:

  • src/pentesting-web/account-takeover.md

  Added a new section on:

  • predictable SSO/bearer cookies
  • cross-application branch forcing
  • two-stage auth replay (/j_security_check-style)
  • source-IP / proxy-trust constraints
  • rate-limit-aware enumeration
  • safe detection via impossible-token cleanup behavior

  Also added references for:

  • Bishop Fox blog
  • Bishop Fox detector repo

  Verified the change is only in that single file. mdbook wasn’t installed, so I couldn’t run a local build.

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Account Takeover, with a new subsection such as Predictable SSO/Bearer Tokens and Two-Stage Authentication Replay; cross-reference Cookies Hacking and Rate Limit Bypass".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0