External risk intelligence

Secret Server PIN Biometric Check Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-115828

Secret Server is a privileged access management solution typically deployed as a centralized, internet-facing or edge-reachable administrative portal to manage credentials and secrets across an organization, making its authentication interfaces common targets for external network reachability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Secret Server that may allow unauthorized access to sensitive information by bypassing authentication checks when using specific security devices. This issue affects earlier versions of the on-premise Secret Server before version 12.3.1. The primary concern is confirming relevance and exposure given the potential for bypassing security controls.

Authentication checks can be bypassed.
Protects sensitive secrets and privileged access.
Verify if your Secret Server is affected.

Attack Path

How an attacker could exploit the issue

An attacker could potentially bypass authentication on an on-premise Secret Server by exploiting how it handles PIN or biometric checks with FIDO2 devices. This could allow unauthorized access to sensitive information managed by the server.

Requires network access and a FIDO2 device.
Bypasses PIN or biometric validation.
Risk of unauthorized access to secrets.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the security of sensitive data managed by Secret Server when a FIDO2-compliant device is used, as PIN or biometric checks may not always be validated. This could potentially allow unauthorized access to protected secrets and system information, depending on how the affected systems are configured and accessed.

Access to sensitive secrets.
Bypass of PIN/biometric authentication.
Unauthorized access to protected data.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, teams responsible for managing Secret Server, such as platform or security operations, should lead the response. The immediate first step is to confirm the presence and reachability of Secret Server instances, identify the accountable system owners, and then assess the business criticality to prioritize remediation efforts.

Ownership: Platform and Security Operations teams.
Verify first: Secret Server instances and reachability.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Secret Server and what is it used for?

Secret Server is an on-premises Privileged Access Management (PAM) software used by organizations to centrally store, manage, and secure sensitive credentials and administrative passwords. It acts as a digital vault, controlling who can access critical infrastructure and systems across an IT environment.

How does CVE-2026-115828 affect authentication?

This vulnerability involves a failure in the software's security logic, categorized as CWE-284: Improper Access Control. It means that when a user attempts to authenticate using a FIDO2-compliant device, the system may fail to properly verify the required PIN or biometric data, potentially allowing an unauthorized entry to bypass this specific layer of security.

Do I need a specific device to trigger this vulnerability?

Yes, the vulnerability specifically relates to how the system interacts with FIDO2-compliant authentication devices. It is not triggered by standard password-only logins or other MFA methods that do not involve FIDO2. The issue is confined to the processing logic when these specific hardware security keys or biometric authenticators are utilized.

Is my Secret Server instance at risk?

Halo Surface Signal indicates that because Secret Server is frequently deployed as an internet-facing administrative portal to facilitate credential management, it often sits at the network edge. If your instance is reachable from the internet, the potential for unauthorized access is higher, making it a priority to check your version against the advisory.

When should I take action to address this flaw?

You should prioritize this immediately if you are running an on-premise version earlier than 12.3.1. Start by verifying which instances of Secret Server are currently running in your environment and confirm their network reachability. Once you have identified the affected servers, coordinate with your system owners to plan and apply the necessary updates to secure your privileged access environment.

References

delinea.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.