Skip to content
OpenAdvisories
Critical · 9.5 CVE-2026-15640 EUVD-2026-80069GHSA-43cm-c736-gj85

Authentication Bypass via SAML Response Manipulation

Published Sep 15, 2026 · Updated Sep 16, 2026 · Assigned by Delinea

Description

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

Affected products

VendorProductAffectedFixed
Delinea Secret Server (On-Prem) 10.5.0 – ≤ 12.1.3 —

References