Description
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
Published: 2026-10-30
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to Secret Server version 12.3.1

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://delinea.com/security-advisories cve-icon cve-icon
History

Fri, 30 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Delinea
Delinea secret Server
Vendors & Products Delinea
Delinea secret Server

Fri, 30 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
Title Secret Server partial login bypass
Weaknesses CWE-288
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Delinea Secret Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Delinea

Published:

Updated: 2026-10-30T19:57:00.723Z

Reserved: 2026-10-23T16:54:29.983Z

Link: CVE-2026-115829

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T20:17:02.107

Modified: 2026-10-30T20:17:02.107

Link: CVE-2026-115829

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T22:15:14Z

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel