EUVD-2026-70252
GHSA-frh3-mpfw-wxxq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach on-prem Secret Server auth endpoint
-
DeliveryAbuse FIDO2 enrollment flow
-
ExploitBind attacker authenticator to target account
-
ExecutionAuthenticate as impersonated user
-
ImpactExtract vault secrets and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the on-premises deployment only - Delinea cloud/SaaS is out of scope, which is the primary limiting factor. The attacker must be able to drive the FIDO2/WebAuthn credential-registration flow to bind an attacker-controlled authenticator to a specific target account, and the advisory explicitly states this works only 'under specific conditions' (the exact triggering precondition is not detailed in the available data and should be confirmed with Delinea). No user interaction by the victim and no prior authentication are indicated by the CVSS vector (UI:N/PR:N), but the 'specific conditions' caveat means this is not reliably exploitable against arbitrary accounts in default state. |
| Impact | The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) portrays a fully remote, unauthenticated, trivial attack, but the description's phrase 'under specific conditions' directly conflicts with AC:L and PR:N - some precondition (likely a state involving the target account's enrollment or an existing foothold/knowledge) is required, which argues for AC:H and knocks real-world exploitability below the headline score. No EPSS value was supplied, there is no KEV listing, and no POC has surfaced, so there is no evidence of active or imminent mass exploitation. That said, the target is a PAM vault, so successful account takeover has outsized blast radius (secrets, downstream credentials), making this a high-priority patch for organizations running the on-prem edition despite the uncertain preconditions. Treat the 9.8 as an upper bound and verify the exact triggering conditions with Delinea before deprioritizing. |
| Exploit ScenarioDerived | An attacker who can reach the on-prem Secret Server authentication endpoint and satisfy the enrollment precondition registers their own FIDO2 authenticator against a targeted privileged account, then completes a normal passwordless login as that user. Once inside the PAM vault, they retrieve stored secrets and pivot to the downstream systems those credentials protect. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'
RemediationAI
Apply the fixed Delinea Secret Server on-prem build referenced in the vendor security advisory (https://delinea.com/security-advisories) - no exact fixed version was provided in the input data, so obtain the precise patched build from Delinea and upgrade. As compensating controls until patched: restrict network reachability of the Secret Server web/authentication interface to trusted admin networks or VPN to shrink the remote attack surface; if operationally feasible, disable or restrict FIDO2/WebAuthn passwordless enrollment and fall back to another MFA method, accepting the usability trade-off, since the flaw is in the FIDO2 credential-registration path; and audit existing FIDO2 credential registrations for unexpected or recently added authenticators bound to privileged accounts, revoking any that cannot be attributed to the legitimate owner. Cloud/SaaS tenants require no action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Delinea Secret Server is an enterprise privileged-access-management (PAM) / secrets-vault platform (formerly Thycotic). The flaw lives in its FIDO2/WebAuthn passwordless-authentication enrollment flow: the process that binds a FIDO2 authenticator (public-key credential) to a user account does not adequately verify that the enrolling party legitimately controls that account, so an attacker can associate their own authenticator with a target account. CWE-290 (Authentication Bypass by Spoofing) captures the root cause - the trust decision relies on a spoofable/insufficiently validated binding rather than proof of the account owner's consent. Per the CPE (cpe:2.3:a:delinea:secret_server_(on-prem)), only the self-hosted on-premises product is in scope; Delinea's cloud/SaaS Secret Server is explicitly not affected.
Know when Secret Server On Prem gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N) but 'specific conditions' warrants AC:H; account takeover of a secrets vault gives C:H/I:H, while availability is not directly impacted (A:N).
Primary rating from Vendor (Delinea).
CVSS VectorVendor: Delinea
DescriptionCVE.org
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Executive ViewAI
Delinea Secret Server (on-premises) contains an authentication bypass vulnerability enabling attackers to register unauthorized FIDO2 credentials and gain administrative access to user accounts, directly compromising the privileged-access-management vault and all secrets it protects. Organizations relying on Secret Server for credential storage face immediate risk of widespread credential compromise affecting their entire infrastructure-access posture.
Disable FIDO2 credential self-service registration and restrict FIDO2 enrollment to a whitelist of administrative accounts only. Enforce multi-factor authentication through alternative channels (TOTP authenticators, hardware security keys not FIDO2-based, or push-notification MFA). Implement detailed logging of all credential-registration events with alerting for out-of-policy enrollment attempts. These are interim only; no vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB