CVE-2025-66413: 
Git vulnerability analysis and mitigation

CVE-2025-66413 is an NTLM hash disclosure vulnerability in Git for Windows that allows an attacker to capture a victim's NTLMv2 hash by tricking them into cloning a repository from a malicious server. Affecting all Git for Windows versions up to and including v2.53.0, the flaw was disclosed on March 10, 2026, and fixed in v2.53.0(2). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, or 7.4 (High) per the GitHub Security Advisory, reflecting the network-based, user-interaction-required attack (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): when a user runs git clone against an attacker-controlled server, Git for Windows may initiate NTLM authentication and transmit the user's NTLMv2 hash to the remote server without adequate safeguards. The fix addresses this by disabling NTLM authentication by default in Git for Windows (GitHub Release). No special privileges are required on the attacker's side — controlling a server that the victim clones from is sufficient. The advisory credits researcher weirdmachine64 for discovery and includes a screencast demonstrating the attack (GitHub Advisory).

Successful exploitation results in the disclosure of the victim's NTLMv2 credential hash to the attacker, which can then be subjected to offline brute-force attacks to recover the plaintext Windows account username and password. Because NTLM hashing is considered cryptographically weak, recovery of credentials is feasible with modern hardware. Compromised credentials could enable lateral movement within corporate Windows environments, access to shared resources, and further account takeover (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, with concrete reproduction steps using the responder tool to capture NTLM hashes. The EPSS score is approximately 0.031%, indicating low but non-negligible automated exploitation probability. There is no current evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report (GitHub Advisory, Red Hat CVE).

1. Set up a malicious server: The attacker configures a Git-compatible server (e.g., using a custom HTTP/HTTPS server or SMB share) that they control and can use to intercept authentication attempts.
2. Deploy Responder: On the attacker's host, run responder (e.g., sudo responder -I eth0) to listen for and capture incoming NTLM authentication challenges and responses.
3. Trick the victim: Social-engineer the target Windows user into running git clone <attacker-controlled-URL> — for example, via a phishing email, malicious link, or compromised CI/CD pipeline configuration.
4. Capture the NTLMv2 hash: When the victim executes the clone command, Git for Windows initiates NTLM authentication toward the attacker's server; Responder captures the NTLMv2 hash.
5. Brute-force credentials: Use a tool such as hashcat or john with a wordlist to offline brute-force the captured NTLMv2 hash and recover the victim's plaintext Windows account credentials (GitHub Advisory).

• Network: Outbound NTLM authentication traffic (TCP/UDP port 445 or HTTP NTLM negotiate headers) from a Windows workstation to an unexpected or external IP address during a git clone operation; unexpected SMB or HTTP NTLM handshake packets to non-corporate servers.
• Logs: Windows Security Event Log entries (Event ID 4648 – Logon using explicit credentials, or Event ID 4624/4625) showing NTLM authentication attempts to external or unfamiliar hosts; Git command history showing git clone of an unfamiliar or external repository URL.
• Process: git.exe spawning network connections to external IPs not associated with known Git hosting services (e.g., GitHub, GitLab, Bitbucket); responder-like tool activity on the network captured via IDS/IPS signatures for NTLM relay/capture tools.

Upgrade Git for Windows to version 2.53.0(2) or later, which disables NTLM authentication by default, eliminating the attack vector (GitHub Release). As a network-level workaround, restrict outbound NTLM authentication requests from developer workstations using Windows Group Policy (Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers). Users should exercise caution when cloning repositories from untrusted or unfamiliar sources, and organizations should consider allowlisting approved Git server URLs (GitHub Advisory).

The vulnerability generated community discussion on Reddit's r/sysadmin, where users discussed the practical risk and remediation steps. Microsoft's documentation on NTLM deprecation was referenced in the advisory, reflecting broader industry movement away from NTLM. The fix was noted as a security-only patch release (v2.53.0(2)), signaling the maintainers' prioritization of the issue (GitHub Advisory).