Secret Server EUVD-2026-114373

Exploitation requires the ability to submit a JWT to Secret Server's authentication/token-handling flow and depends on the server accepting an unsigned (non-signature-verified) token, which the description scopes to 'certain conditions' that are not enumerated in the available sources - the precise trigger is not described in the available sources. Limiting factors per the vendor CVSS vector: the attack is network-reachable (AV:N) but has high attack complexity (AC:H), and PR:H indicates an existing privileged/authenticated context is expected rather than fully anonymous access; the flaw is remediated in Secret Server 12.3.1, so only versions earlier than 12.3.1 are affected.

This is a server-side authorization flaw (CWE-863) in Delinea Secret Server where an unsigned JWT can be exchanged for cloudadmin permissions - effectively a full privilege-escalation/authentication-bypass in a privileged access management product that holds enterprise secrets. The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:H/AT:N/PR:H/UI:N and high confidentiality/integrity impact on both the vulnerable and a subsequent system (VC:H/VI:H, SC:H/SI:H), reflecting that compromise of a secrets vault cascades to downstream systems. Counterbalancing signals: AC:H indicates the attack is not trivially repeatable (the description qualifies it with 'under certain conditions'), and PR:H in the vendor vector means some existing privilege/authenticated context is expected rather than fully anonymous access. There is no CISA KEV listing, no EPSS probability supplied, and no POC or exploit reference in the input, so there is no evidence of active or proven exploitation. The vuln.today decision label is 'this_week' (elevated but not emergency), which is consistent with a high-impact-but-not-yet-exploited authorization bug. Net: treat as a genuine priority given the product's role as a secrets custodian and the high impact, but current data shows no confirmed exploitation and a non-trivial attack complexity, so this is a scheduled-urgent patch rather than a drop-everything emergency. Key missing signals: EPSS, KEV, and the specific 'certain conditions' are not detailed in available sources - verify with Delinea's advisory.

An attacker who can reach the Secret Server authentication/token flow crafts a JWT with no valid signature (e.g., an unsigned/'none'-style token) and submits it; under the right conditions the server accepts it and returns a session carrying cloudadmin permissions, granting control over the secrets vault. No public exploit code is identified in the available data, and the exact triggering conditions and attack complexity (CVSS AC:H) suggest exploitation is not trivially reliable.