CVE-2026-115829 Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
CriticalCVSS 9.9
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Delinea Secret Server (On-Prem) | >= older versions, <= 12.2.7 | No fix listed |