Live › vulnerability › CVE-2026-115829
In Secret Server before 12.3.1, a user can skip the initial login step and sign in by completing only the second-factor step. An attacker who can reach the login page may gain access to the password vault without the first credential.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Organizations that run Secret Server on-premises at a version earlier than 12.3.1 are exposed, since the flaw lies in its multi-step login flow. Systems where Secret Server is not deployed can skip it. The sources do not say whether managed or hosted instances are affected.
No product ranges from the sources yet.
12.3.1.12.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
This page as .md · .json · in your agent: get_signal("CVE-2026-115829")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.