CVE-2026-19117
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.28%
- CWE
- CWE-290
- Published
- 2026-09-02
- Last modified
- 2026-09-02
Affected products
- Delinea Secret Server (On-Prem)
- Delinea Secret Server (On-Prem)
- Delinea Secret Server (On-Prem)
- Delinea Secret Server (On-Prem)
- Delinea Secret Server (On-Prem)
Weakness type
Related vulnerabilities
- CVE-2026-63427 — An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a...
- CVE-2026-88011 — Traefik: ForwardAuth identity spoofing via dot-form header alias
- CVE-2026-66674 — WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
- CVE-2026-88879 — Traefik before v2.11.56 Identity Spoofing via Header Alias
- CVE-2026-82563 — Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing
- CVE-2026-82530 — IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
- CVE-2026-62759 — Windows Netlogon Spoofing Vulnerability
- CVE-2026-86478 — In JetBrains YouTrack before 2025.3.161254,...