Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-19117: On‑premises server lets attacker add fake FIDO2 login
CVE-2026-19117 · published 1 day ago
Summary
If you run the software on your own servers, a flaw can let a malicious person create a fake security key for a user’s account and then sign in as that user. This could give an attacker access to the same resources the legitimate user has. Apply the vendor’s security update or move to a cloud version that has the fix as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| delinea | secret server (on-prem) | <= 11.7.61 |
Original advisory text
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as
that user. This issue affects on-premises deployments o...
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as
that user. This issue affects on-premises deployments only.
that user. This issue affects on-premises deployments only.
References
- https://delinea.com/security-advisories vendor-advisory
Severity
9.8
Critical
CVSS 3.1: 9.8 (MITRE)
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published2 Sep 2026
Updated2 Sep 2026
First seen2 Sep 2026
Monitor software like this
Free during beta