CVE-2026-115828
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In Secret Server versions earlier than 12.3.1, the application did not always validate the PIN or biometric check when using a FIDO2-compliant device. This may allow bypassing the additional second-factor verification.
Risk Assessment
An attacker holding only the FIDO2 device could gain access without the required PIN or biometrics, weakening multi-factor authentication. This poses a risk of unauthorized access to stored secrets.
Recommendation
Update Secret Server to version 12.3.1 or later. Verify that FIDO2 authentication enforces PIN and biometric checks according to security policy.
Other vulnerabilities in Secret Server
See all- CVE-2026-15640Critical
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.
- CVE-2026-15639Critical
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.
- CVE-2026-15638Critical
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
- CVE-2026-115830High
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response. The vulnerability allows privilege escalation to administrative level.
- CVE-2026-115829High
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating only the second factor login step. The vulnerability bypasses the first authentication factor.
Original NVD description (English source)
In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
Vulnerability data from NVD (NIST) · CISA KEV · EPSS