9.8Crítica
CVE-2026-19117Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
Descripción
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Debilidad (CWE):
CWE-290
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Delinea | Secret Server (On-Prem) | 10.6.0 – ≤ 11.7.61, 11.8.0 – ≤ 11.8.1, 11.9.0 – ≤ 11.9.47, 12.0.0 – ≤ 12.0.22, 12.1.0 – ≤ 12.1.2 |
Referencias y parches
- https://delinea.com/security-advisories vendor-advisory