Live › vulnerability › CVE-2026-115828
Secret Server versions earlier than 12.3.1 did not always validate the PIN or biometric check when a FIDO2-compliant device was used. An attacker who can reach the login flow may be able to get past that second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Organisations running Secret Server earlier than 12.3.1 that use FIDO2-compliant devices as an authentication factor. Sources do not state whether exploitation requires valid credentials or the internet-facing exposure of the instance.
No product ranges from the sources yet.
12.3.112.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
This page as .md · .json · in your agent: get_signal("CVE-2026-115828")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.