CVE-2026-19117
Received
Published: 02 Sept 2026, 18:04
Last modified:02 Sept 2026, 18:32
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
02 Sept 2026, 18:04
Published
Vulnerability first disclosed
02 Sept 2026, 18:32
Last Modified
Vulnerability information updated
Description
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Techniques & Countermeasures
- CWE-290•Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected Systems
- delinea•secret server (on-prem)
≥ 10.6.0, ≤ 11.7.61 | ≥ 11.8.0, ≤ 11.8.1 | ≥ 11.9.0, ≤ 11.9.47 | ≥ 12.0.0, ≤ 12.0.22 | ≥ 12.1.0, ≤ 12.1.2