{"vulnerability": "cve-2026-67596", "sightings": [{"uuid": "d4414ab2-78f1-4451-9b0f-4ade924c8ce7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67596", "type": "seen", "source": "https://gist.github.com/fkan001/9eb1ebd3d98743c920f2fd241a51ccbb", "content": "# G03-20 \u2014 PCCW Entra Tenant c5924da6 Deep Recon\nDate: 2026-08-02 | Operator: EH | ROE: unauth/read-only, single-attempt credential discipline\nEvidence root: /mnt/agents/output/evidence/work/g03-tenant-c5924da6/ (all items evlogged, sha256 in manifest, gist-synced)\n\n## 1. Tenant liveness \u2014 CONFIRMED\n- Tenant c5924da6-deb3-421b-aa98-57bcba0ba050 live; v2.0 openid-configuration served; token endpoint accepts client_secret_post/basic, private_key_jwt.\n- Evidence: openid-config.json\n\n## 2. Domain \u2192 tenant map \u2014 CONFIRMED (unauth, getuserrealm.srf + openid-config)\n| Domain | Tenant | Type |\n|---|---|---|\n| pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| corphq.hk.pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| pccwsolutions.com | **c5924da6** | Managed (cloud auth) |\n| hkt.com | **c5924da6** | Managed |\n| hkcsl.com | **c5924da6** | Managed |\n| theclub.com.hk | **c5924da6** | Managed |\n| netvigator.com | faa25108-\u2026 | Managed \u2014 SEPARATE tenant |\n| pccwglobal.com | 024d6fa0-\u2026 | Managed \u2014 SEPARATE tenant |\n| nowtv.com | 68b865d5-\u2026 | Managed \u2014 SEPARATE tenant |\n| biznetvigator.com | 3aa20025-\u2026 | Managed \u2014 SEPARATE tenant |\n| hkt.com.hk, csl.com.hk, 1010.com.hk, cslmobile.com, onenet.com.hk | none | Unknown |\n| now.com.hk, viu.com, moov.com.hk, club.com.hk, hkteducation.com, hkte.com, hktpremier.com, pccwmobile.com, eyechat.com.hk, uhubplus.com | various others | Unknown/other tenants |\n- Evidence: domain-tenant-map.txt\n- Key blast-radius correction: **netvigator.com and pccwglobal.com are NOT in c5924da6** \u2014 Monday-token blast radius is the 6 c5924da6 domains, not the whole brand family.\n\n## 3. Leaked app db684a8a \u2014 Variant C status: BLOCKED (single attempt, ROE-compliant)\n- POST token (client_credentials) \u2192 AADSTS7000222: \"provided client secret keys \u2026 are EXPIRED\".\n- 7000222 fires after app lookup \u21d2 **app registration db684a8a is ALIVE** in tenant; only the leaked secret is dead (expired, not revoked-visible).\n- Implication: MFA-bypass Variant C (app client_credentials) is currently BLOCKED for us. But the app object surviving means: (a) HKT remediation scrubbed the secret value's validity window, not the app; (b) if the owner (Kilson's process) still owns the app, only Variant B (dispenser refresh-token) remains the live vending path \u2192 Monday poll is decisive.\n- Evidence: token-attempt-1.json (Trace d6bf1081)\n\n## 4. ADFS rms.pccw.com \u2014 CONFIRMED internet-facing corporate IdP\n- TLS cert: O=PCCW-HKT DataCom Services Limited, CN=rms.pccw.com, GlobalSign, valid to 2026-10-13. Attribution CONFIRMED corporate (attack-surface-recon checklist item 3).\n- federationmetadata.xml + adfs .well-known/openid-configuration served unauth.\n- Sign-in page /adfs/ls: FormsAuthentication with Username+Password enabled \u2192 internet-exposed password endpoint for BOTH federated domains (pccw.com, corphq.hk.pccw.com).\n- Password-spray surface: NOT TESTED (ROE: no spray without explicit ZY go). Label: ANALYTIC (surface observed, exploitability untested).\n- Evidence: adfs-fedmeta.xml, adfs-ls.html\n\n## 5. SharePoint Online tenancies \u2014 CONFIRMED existence \u00d73\n- pccw0.sharepoint.com, pccw.sharepoint.com, hkt.sharepoint.com all return 307 (tenant exists); hktenterprise/pccwglobal SPO do not resolve from sandbox.\n- Note: multiple SPO tenancies vs one Entra tenant = tenancy sprawl; each SPO root has its own anon-sharing posture (gated 403 on root, expected).\n\n## 6. Seamless SSO \u2014 UNPROVEN\n- autologon.microsoftazuread-sso.com/pccw.com returned generic HTML sign-in (200), not the Kerberos/usernamemixed WIA endpoint response \u2192 cannot confirm seamless-SSO computer-account AZUREADSSOACC exposure unauth. Kept as honest negative.\n\n## 7. Closures per ZY 2026-08-02\n- emailService SEND: confirmed unexploitable by ZY inbox check \u21d2 **13/13 G03-17 flows dead**. Final label: BLOCKED (remediated).\n- CVE-2026-67596 (CSL 3G module): DROPPED per ZY. Prior verdict stands (no remote vector, customer CPE attribution, EOL \u2192 census/isolate). Logged as --type note closure.\n\n## 8. Attack-surface deltas worth ZY attention\n1. ADFS forms-auth endpoint internet-facing + federated pccw.com = single password-guess channel into corporate creds; recommend ADFS extranet lockout/smart-lockout verification + WAF rate-limit. (ANALYTIC)\n2. App db684a8a still exists in tenant \u2014 recommend delete app reg entirely, not just secret expiry; also audit other secrets/certs on the app (we can only see the expired one unauth). (CONFIRMED existence / ANALYTIC residual risk)\n3. Tenancy hygiene: 6 domains on c5924da6 incl. legacy LPS (pccwsolutions.com) \u2014 R10 finding cross-ref: de-federate/retire LPS domain from corporate tenant. (CONFIRMED mapping)\n", "creation_timestamp": "2026-08-02T09:09:28.125583Z"}, {"uuid": "ee9e0682-ed20-4704-bf2c-b8008bed7524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67596", "type": "seen", "source": "https://gist.github.com/fkan001/86026af6c6a04b70229801e3a084d44a", "content": "# G03-20 \u2014 PCCW Entra Tenant c5924da6 Deep Recon\nDate: 2026-08-02 | Operator: EH | ROE: unauth/read-only, single-attempt credential discipline\nEvidence root: /mnt/agents/output/evidence/work/g03-tenant-c5924da6/ (all items evlogged, sha256 in manifest, gist-synced)\n\n## 1. Tenant liveness \u2014 CONFIRMED\n- Tenant c5924da6-deb3-421b-aa98-57bcba0ba050 live; v2.0 openid-configuration served; token endpoint accepts client_secret_post/basic, private_key_jwt.\n- Evidence: openid-config.json\n\n## 2. Domain \u2192 tenant map \u2014 CONFIRMED (unauth, getuserrealm.srf + openid-config)\n| Domain | Tenant | Type |\n|---|---|---|\n| pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| corphq.hk.pccw.com | **c5924da6** | Federated (ADFS rms.pccw.com) |\n| pccwsolutions.com | **c5924da6** | Managed (cloud auth) |\n| hkt.com | **c5924da6** | Managed |\n| hkcsl.com | **c5924da6** | Managed |\n| theclub.com.hk | **c5924da6** | Managed |\n| netvigator.com | faa25108-\u2026 | Managed \u2014 SEPARATE tenant |\n| pccwglobal.com | 024d6fa0-\u2026 | Managed \u2014 SEPARATE tenant |\n| nowtv.com | 68b865d5-\u2026 | Managed \u2014 SEPARATE tenant |\n| biznetvigator.com | 3aa20025-\u2026 | Managed \u2014 SEPARATE tenant |\n| hkt.com.hk, csl.com.hk, 1010.com.hk, cslmobile.com, onenet.com.hk | none | Unknown |\n| now.com.hk, viu.com, moov.com.hk, club.com.hk, hkteducation.com, hkte.com, hktpremier.com, pccwmobile.com, eyechat.com.hk, uhubplus.com | various others | Unknown/other tenants |\n- Evidence: domain-tenant-map.txt\n- Key blast-radius correction: **netvigator.com and pccwglobal.com are NOT in c5924da6** \u2014 Monday-token blast radius is the 6 c5924da6 domains, not the whole brand family.\n\n## 3. Leaked app db684a8a \u2014 Variant C status: BLOCKED (single attempt, ROE-compliant)\n- POST token (client_credentials) \u2192 AADSTS7000222: \"provided client secret keys \u2026 are EXPIRED\".\n- 7000222 fires after app lookup \u21d2 **app registration db684a8a is ALIVE** in tenant; only the leaked secret is dead (expired, not revoked-visible).\n- Implication: MFA-bypass Variant C (app client_credentials) is currently BLOCKED for us. But the app object surviving means: (a) HKT remediation scrubbed the secret value's validity window, not the app; (b) if the owner (Kilson's process) still owns the app, only Variant B (dispenser refresh-token) remains the live vending path \u2192 Monday poll is decisive.\n- Evidence: token-attempt-1.json (Trace d6bf1081)\n\n## 4. ADFS rms.pccw.com \u2014 CONFIRMED internet-facing corporate IdP\n- TLS cert: O=PCCW-HKT DataCom Services Limited, CN=rms.pccw.com, GlobalSign, valid to 2026-10-13. Attribution CONFIRMED corporate (attack-surface-recon checklist item 3).\n- federationmetadata.xml + adfs .well-known/openid-configuration served unauth.\n- Sign-in page /adfs/ls: FormsAuthentication with Username+Password enabled \u2192 internet-exposed password endpoint for BOTH federated domains (pccw.com, corphq.hk.pccw.com).\n- Password-spray surface: NOT TESTED (ROE: no spray without explicit ZY go). Label: ANALYTIC (surface observed, exploitability untested).\n- Evidence: adfs-fedmeta.xml, adfs-ls.html\n\n## 5. SharePoint Online tenancies \u2014 CONFIRMED existence \u00d73\n- pccw0.sharepoint.com, pccw.sharepoint.com, hkt.sharepoint.com all return 307 (tenant exists); hktenterprise/pccwglobal SPO do not resolve from sandbox.\n- Note: multiple SPO tenancies vs one Entra tenant = tenancy sprawl; each SPO root has its own anon-sharing posture (gated 403 on root, expected).\n\n## 6. Seamless SSO \u2014 UNPROVEN\n- autologon.microsoftazuread-sso.com/pccw.com returned generic HTML sign-in (200), not the Kerberos/usernamemixed WIA endpoint response \u2192 cannot confirm seamless-SSO computer-account AZUREADSSOACC exposure unauth. Kept as honest negative.\n\n## 7. Closures per ZY 2026-08-02\n- emailService SEND: confirmed unexploitable by ZY inbox check \u21d2 **13/13 G03-17 flows dead**. Final label: BLOCKED (remediated).\n- CVE-2026-67596 (CSL 3G module): DROPPED per ZY. Prior verdict stands (no remote vector, customer CPE attribution, EOL \u2192 census/isolate). Logged as --type note closure.\n\n## 8. Attack-surface deltas worth ZY attention\n1. ADFS forms-auth endpoint internet-facing + federated pccw.com = single password-guess channel into corporate creds; recommend ADFS extranet lockout/smart-lockout verification + WAF rate-limit. (ANALYTIC)\n2. App db684a8a still exists in tenant \u2014 recommend delete app reg entirely, not just secret expiry; also audit other secrets/certs on the app (we can only see the expired one unauth). (CONFIRMED existence / ANALYTIC residual risk)\n3. Tenancy hygiene: 6 domains on c5924da6 incl. legacy LPS (pccwsolutions.com) \u2014 R10 finding cross-ref: de-federate/retire LPS domain from corporate tenant. (CONFIRMED mapping)\n", "creation_timestamp": "2026-08-02T09:29:17.334563Z"}]}