CVE-2026-115828 in Secret Server
Summary
by MITRE • 10/30/2026
In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Ivanti Secret Server prior to version 12.3.1 represents a critical failure in the implementation of multi-factor authentication protocols involving hardware security keys. Specifically, the application failed to consistently enforce the requirement for user verification when utilizing FIDO2-compliant devices during the login process. This flaw undermines the fundamental security premise of phishing-resistant authentication methods, which rely on the binding of cryptographic credentials to both a specific server and an active human presence at the time of access. By neglecting to validate the PIN or biometric check mandated by the FIDO2 standard, the system allowed for potential unauthorized access scenarios where the physical possession of the security key was sufficient for authentication without confirming that the legitimate user was physically present and actively authorizing the transaction.
From a technical perspective, this issue stems from an incomplete implementation of the Client to Authenticator Protocol within the Secret Server application logic. When a FIDO2 authenticator is presented during login, the server must request specific flags indicating whether user verification has occurred. In vulnerable versions, the authentication flow proceeded successfully even if these flags indicated that no PIN or biometric check had been performed by the hardware token. This effectively downgrades the security posture from phishing-resistant multi-factor authentication to simple two-factor authentication based solely on possession of a device. An attacker who obtains or compromises a user's FIDO2 key could potentially bypass the intended layer of identity confirmation, as the server would accept the cryptographic signature generated by the key without ensuring that the required local verification step was completed by the end-user.
The operational impact of this vulnerability is severe for organizations relying on Secret Server to protect sensitive credentials and privileged access management functions. Since FIDO2 keys are often used in high-security environments due their resistance to phishing attacks, exploiting this flaw allows an adversary who has acquired a user's physical key to gain full administrative or user-level access without needing the associated PIN or biometric data. This creates a significant risk of credential theft and lateral movement within enterprise networks. The vulnerability aligns with CWE-287 Improper Authentication because it involves a failure in verifying identity through one or more authentication factors, specifically neglecting the verification component required by the FIDO2 specification. Furthermore, this flaw can be mapped to MITRE ATT&CK technique T1078 Valid Accounts, as it facilitates unauthorized access using legitimate credentials that are not being used according to their intended security policies.
Mitigation for this vulnerability requires immediate action to ensure system integrity and user safety. The primary remediation step is to upgrade Ivanti Secret Server to version 12.3.1 or later, where the authentication logic has been corrected to strictly enforce FIDO2 user verification requirements before granting access. Organizations should also audit their current deployment configurations to identify any systems running vulnerable versions that may be exposed to external networks or untrusted internal segments. In addition to patching, administrators should review logging mechanisms to detect anomalous login patterns that might indicate exploitation attempts, such as successful authentications from FIDO2 keys where user verification flags were unexpectedly absent if the system logs this information. Continuous monitoring and adherence to strict identity governance policies are essential to maintain a robust security posture against evolving threats targeting authentication infrastructure.