KerberLoss: three invisible bytes that hijack a Kerberos service
Here is a service principal name:
cifs/DC1 And here is another one:
cifs/DC1 They are not the same string. The second one ends with U+200C, a zero width non-joiner. Three bytes, e2 80 8c, that your terminal, your browser and your eyes all agree to pretend do not exist.