Secret Server On Prem
Monthly
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'