Description: A security regression was discovered during the testing of an upcoming feature in Satellite 6.13, which allows the usage of Kerberos for CLI and API. Although this may be considered a feature rather than a bug, it introduces a new attack vector through CSRF. The issue allows an attacker to obtain an API session cookie in a browser, even if the user has never logged into the Satellite or entered their credentials. The only prerequisite is that the user has a Kerberos Ticket Granting Ticket (TGT) obtained through 'kinit'. With this API session cookie, the attacker can perform CSRF attacks against the API, bypassing CSRF protection and carrying out malicious actions under the user's name, without formal consent of the user. Impacted Satellite Version: 6.13