CVE-2026-115829
Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- Record
CVE-2026-115829- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - Weakness
- CWE-288
- Updated
- 2026-11-05
EUVDEUVD-2026-114374
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- Record
EUVD-2026-114374- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-x74x-ghfp-72vj
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and...
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
- Record
GHSA-x74x-ghfp-72vj- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- Record
CVE-2026-115829- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-288
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| products | EUVD | |
| description, facts, products, severity, title | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115829 is a critical vulnerability (CVSS 9.9) in Delinea Secret Server (on-prem), published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. No source names a fixed version.