EUVD-2026-80069
GHSA-43cm-c736-gj85
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SAML endpoint (AV:N), condition-gated so AC:H; no attacker account needed (PR:N); impersonation of another user crosses an authentication scope (S:C) yielding high C/I over secrets, no availability impact (A:N).
Primary rating from Vendor (1443cd92-d354-46d2-9290-d812316ca43a).
CVSS VectorVendor: 1443cd92-d354-46d2-9290-d812316ca43a
Lifecycle Timeline
3DescriptionCVE.org
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
AnalysisAI
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that Secret Server (On-Prem, versions 10.5.0 through 12.1.3) be configured to use SAML-based single sign-on - the flaw is in processing of SAML IdP responses, so environments not using SAML SSO are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority authentication flaw, but its raw 9.5 CVSS 4.0 score overstates the ease of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The source data does not identify a specific vendor-released patch version, so the exact fixed build should be confirmed against Delinea's security advisory page (https://delinea.com/security-advisories) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-15640) before scheduling an upgrade; note that the affected range terminates at 12.1.3, which indicates fixes are in builds later than 12.1.3, but that should be treated as an inference to verify rather than a confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine whether the organization runs Delinea Secret Server (On-Prem) versions 10.5.0 through 12.1.3 and whether SAML-based SSO is enabled; if both are true, treat the deployment as exposed, alert the identity and privileged access management teams, and review recent SAML authentication logs in Secret Server and the IdP for anomalous or unexpected user impersonation events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webs
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protoc
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 c
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. Rate
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machin
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue a
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, l
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. Rated medium severity (CVSS
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Rated medium s
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today