Authentication Bypass via SAML Response Manipulation - CVE-2026-15640
CVE-2026-15640
Summary
The distributed engine of Secret Server version 11.7.49 and earlier allows an attacker to impersonate another distributed engine by exploiting a vulnerability in an initial authorization event.
Products covered
Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later
Remediation
Vendor-listed fixes
Upgrade to Secret Server version 11.7.60 or later
CVEs in this advisory 1
Updates
- Published by Delinea
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.