Delinea Secret Server CVE-2026-15640

Requires that Secret Server (On-Prem, versions 10.5.0 through 12.1.3) be configured to use SAML-based single sign-on - the flaw is in processing of SAML IdP responses, so environments not using SAML SSO are not affected. Exploitation further depends on unspecified 'certain conditions' (reflected as AC:H/AT:P in the CVSS vector), meaning a specific precondition in the SAML assertion handling or SSO configuration must hold; it is not exploitable against every SAML deployment by default. The attacker needs no pre-existing Secret Server credentials (PR:N) and no victim interaction (UI:N), but must be able to deliver a valid/crafted SAML response to the application's assertion consumer endpoint. Non-SAML authentication configurations and patched versions (post-12.1.3) are the primary limiting factors.

This is a genuine high-priority authentication flaw, but its raw 9.5 CVSS 4.0 score overstates the ease of exploitation. CWE-290 (Authentication Bypass by Spoofing) combined with the description ('Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user') maps to a SAML assertion-handling weakness that lets an attacker log in as an arbitrary user of a privileged-access vault - a severe outcome given Secret Server stores privileged credentials. However, the vendor's own vector encodes two real limiters: AC:H (high attack complexity) and AT:P (a present attack requirement/precondition), consistent with the 'under certain conditions' language. The score is inflated by the vendor marking all subsequent-system impacts high (SC:H/SI:H/SA:H) - defensible for a secrets vault (impersonation cascades into theft of stored credentials) but generous. There is no EPSS score, no KEV listing, and no public exploit in the provided data, so exploitation status is: no public exploit identified at time of analysis. The CVSS vector contains PR:N, so exploitation is unauthenticated in the sense that the attacker need not already hold a Secret Server account, but AC:H/AT:P mean it is not a trivial mass-exploitable bug. Net: patch promptly because the product is a credential vault and the impact is impersonation, but this reads as a conditions-dependent, likely targeted issue rather than a wormable internet-wide threat.

An attacker positioned to influence or forge SAML IdP responses (e.g., leveraging a signature-validation or assertion-binding weakness under specific SSO configurations) submits a crafted-yet-valid SAML response to Secret Server's assertion consumer endpoint, causing the application to authenticate them as a different - potentially administrative - user. Once impersonating that user, the attacker gains that account's access to stored privileged secrets. No public proof-of-concept is identified in the available data, and the CVSS AC:H/AT:P metrics indicate specific preconditions must be met for the attack to succeed.