Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough

Delinea has disclosed four critical flaws in on-premises Secret Server, two of which let someone sign in as another user. If you run Secret Server yourself, get to 12.2.7 or later, because that's the only build that closes all four. The quick hotfixes Delinea offered for the FIDO2definitionThe standard behind hardware security keys like a YubiKey. In Secret Server you type your password, then touch the key, and that touch is your second factor. bug leave the other three open, and that's an easy gap to miss.

A PAM vault is the most valuable box on most networks. Whoever can sign in as an admin there can usually read the domain admin password, and from there reach almost anything. So a bug that lets an outsider become another user on Secret Server is about as bad as identity bugs get, even before anyone has used it.

Nobody has reported attacks so far. CISA's enrichment of each CVE record marks exploitation as none, none of the four is on CISA's Known Exploited Vulnerabilities list, and Delinea's advisory doesn't mention attacks. That's the good news. The bad news is that CISA also marks the FIDO2 flaw as automatable, which means an attacker could script it against many servers once someone works out the details.

The scores need one caution. Delinea scored the FIDO2 bug with CVSS v3.1 and the other three with CVSS v4.0, so a 9.8 and a 9.5 aren't directly comparable. The v4 vectors for the SAMLdefinitionWhat sits behind most single sign-on. Entra ID or Okta signs a message saying who you are, and Secret Server lets you in because it trusts that signature. and padding oracledefinitionA bug where a server leaks, through its error messages or timing, whether encrypted data it received was well formed. An attacker uses that to decrypt or forge data without the key. bugs say the attack is harder to pull off and needs certain conditions to be present. The XSS bug needs a user to click a crafted link. None of that makes them safe to leave. It tells you which one to worry about first if you can only do one thing tonight: the FIDO2 one.

For engineers, the 12.2.7 release notes give a few more clues without naming the CVE. They list fixes to the FIDO2 two-factor registration callback, including tighter validation, a corrected challenge comparison and a longer life for the one-time registration key. A wrong challenge comparison is the kind of bug that lets a registration ceremony meant for one session complete for another. Treat that as our reading of the notes, since Delinea hasn't confirmed the root cause.

In Secret Server, FIDO2 is a second factor that comes after the password. That's why this bug is ugly. The key is supposed to be the thing that saves you when a password leaks, and here the key itself was the weak spot. It also matters for cleanup, which we come back to in the playbook: a rogue key stays on the account until someone resets it.

Delinea fixed the FIDO2 bug first, and quietly. Secret Server 12.1.000003 went out with a line saying it fixed CVE-2026-19117, and that details were held back so customers could update before they went public. The CVE record followed about three weeks later, and it lists hotfixes for older lines too. The other three CVEs were published on September 15 and are only fixed in 12.2.7 and later (the XSS bug is also fixed from 12.0.20).

Here's the trap. If your team saw the FIDO2 advisory, took the hotfixdefinitionA small update on an older version line that fixes one specific problem without moving you to the next release. for its line and closed the ticket, the job isn't done. The 12.1.3 hotfix fixes FIDO2, but the SAML and padding oracle bugs affect every version from 10.5 up to and including 12.1.3. The 11.9.48 hotfix leaves those two open and the XSS bug as well, since that one runs through 11.9.48. If your server sits on any of those hotfix builds, at least two of the four are still open, and three on 11.9.48 or older.

One cell in that table deserves a footnote you won't find in the advisory. The XSS fix is listed as 12.0.20 or later, but Delinea withdrew 12.0.000020 and 12.0.000021 from distribution, and told customers with an HSM whose server failed after that upgrade to roll back to 11.9.000047. If you're on a 12.0 build, check which one, and plan the move to 12.2.7 or later instead of stopping on 12.0.

If you only get one check done today, make it the FIDO2 registrations. Each Secret Server user can have one FIDO2 device registered at a time, so a list of registrations is short and easy to read. Any key registered to an admin account that the admin can't account for is a reason to treat the server as compromised.

# example output. Field and event names vary by version and SIEM, so match them to yours
# 1. Every FIDO2 key someone registered, newest first. Each one should match a person you can ask
source = secret-server-audit and action contains "FIDO2" | sort -time | table time user ip
# 2. Admin sign-ins from addresses that aren't on the office or VPN list
action = "LOGIN" and user in ss_admins and ip not in corp_ranges
# 3. One address throwing hundreds of failed requests in ten minutes. That's what padding oracle probing looks like
source = iis and host = secret-server and status >= 400 | count by src_ip, 10m | where count > 500

Secret Server has had seven on-prem advisories in about fifteen months on Delinea's own page, and four of them were critical. Plan for more. The goal is that the next login bug costs you an upgrade night and nothing else, because nobody outside your staff networks can reach the login page and a stolen login still can't see much.

Two of these do most of the work. Getting the login page off the internet turns three of the four CVEs from a remote problem into an insider problem, and the fourth needs someone on your staff to click a link. Alerting on FIDO2 registrations costs almost nothing, because real registrations are rare and each one should match a ticket or a new hire.

One newer fix is worth using while you're in there. Since 12.3.000001, SAML certificate additions and replacements show up in the SAML audit log. Swapping the identity provider certificate is a classic way to make forged sign-ins look valid, so forward that log too.

A word on the padding oracle bug, because it changes what you look for. Delinea says the server's key isn't exposed, but an attacker could decrypt or encrypt data with it. Microsoft's guidance on this class of bug describes the attacker decrypting a message byte by byte by sending slightly changed versions and watching how the server responds. That takes a lot of requests. A burst of thousands of failed requests from one address, sitting in IIS logs that nobody watches, is the thing to search for.

These three are made up. None of them is a real incident or a Cohash client. They're here to show how the same advisory plays out differently depending on where Secret Server runs and which build it's on.

We implement and upgrade Delinea Secret Server, including the step upgrades, distributed engines and launchers that make these jobs slow. If you want a second pair of hands for the move to 12.2.7 or later, or a review of who can see what in your vault afterwards, start with our Delinea page, look at Delinea engineers you can bring in, or take the free assessment to see where your privileged access stands.