Delinea Secret Server CVE-2026-115828

Exploitation requires that authentication is performed using a FIDO2-compliant authenticator and that the attacker can drive that authenticator's flow against a Secret Server instance running a version earlier than 12.3.1; the specific weakness is that the device's PIN or biometric user-verification step is not always validated, so the second-factor possession check succeeds without the user-verification secret. Limiting factors: the vendor CVSS marks PR:H, so the attack is not a fully unauthenticated remote bypass - it presupposes an existing privileged/authentication context or access to a registered FIDO2 device - and the issue only affects deployments that actually use FIDO2 for authentication; environments relying on other authentication methods, or already on 12.3.1+, are not exposed. The sources do not state the precise condition under which validation is skipped ('did not always validate'), so whether it is intermittent or configuration-dependent is unverified.

This is a moderate-severity access-control weakness (CWE-284) in Delinea Secret Server where the PIN or biometric user-verification step of a FIDO2 authenticator is not always validated. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1) indicates a network-reachable, low-complexity issue that nonetheless requires high privileges (PR:H) and yields only low confidentiality and integrity impact to the vulnerable and subsequent systems (VC:L/VI:L/VA:N, SC:L/SI:L/SA:N). The vuln.today decision label is 'this_month' - a routine prioritization, not act_now or emergency. No EPSS score, CISA KEV listing, or PoC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no signal of active or probable exploitation. The signals are internally consistent rather than conflicting: a vendor-reported authentication-robustness gap with limited impact and no exploitation evidence. The practical caveat is the apparent tension between the 'Authentication Bypass' tag and PR:H - the flaw weakens the second-factor user-verification guarantee rather than granting unauthenticated access, so an attacker still needs a valid authentication context or possession of a registered FIDO2 device; verify the exact pre-conditions with Delinea's advisory. Overall this is a legitimate but non-urgent hardening fix, not a high-real-risk emergency.

An attacker who has possession of or access to a user's registered FIDO2 authenticator attempts to log in to Secret Server; because the PIN or biometric user-verification check is not always enforced, the attacker completes authentication without proving knowledge of the PIN or presenting the biometric. No public proof-of-concept is referenced, and the low attack complexity (AC:L) reflects that no special timing or environmental conditions are needed once the pre-conditions are met.