Secret Server Cryptographic and Authentication Flaws

SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.

Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.

A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.