9.8Kritisch
CVE-2026-19117Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
Beschreibung
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Schwachstellentyp (CWE):
CWE-290
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Delinea | Secret Server (On-Prem) | 10.6.0 – ≤ 11.7.61, 11.8.0 – ≤ 11.8.1, 11.9.0 – ≤ 11.9.47, 12.0.0 – ≤ 12.0.22, 12.1.0 – ≤ 12.1.2 |
Referenzen und Patches
- https://delinea.com/security-advisories vendor-advisory