CVE-2026-15640
CriticalCVSS 9.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.
Risk Assessment
An attacker may gain access to other Secret Server users' accounts, potentially leading to unauthorized access to stored secrets and credentials.
Recommendation
Apply the vendor's available patches for Secret Server addressing SAML response validation. Consider restricting or monitoring SAML integrations until the fix is deployed.
Other vulnerabilities in Secret Server
See all- CVE-2026-15639Critical
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.
- CVE-2026-15638Critical
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
- CVE-2026-115830High
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response. The vulnerability allows privilege escalation to administrative level.
- CVE-2026-115829High
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating only the second factor login step. The vulnerability bypasses the first authentication factor.
- CVE-2026-115828Medium
In Secret Server versions earlier than 12.3.1, the application did not always validate the PIN or biometric check when using a FIDO2-compliant device. This may allow bypassing the additional second-factor verification.
Original NVD description (English source)
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS