CVE-2026-115830 in Secret Server
Summary
by MITRE • 10/30/2026
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Ivanti Secret Server prior to version 12.3.1 represents a critical authentication bypass flaw that allows unauthorized escalation of privileges within the application environment. This issue stems from improper validation mechanisms associated with JSON Web Token (JWT) processing, specifically concerning signature verification protocols. In secure implementations, JWTs must be cryptographically signed using a secret key or public/private key pair to ensure integrity and authenticity. The absence of rigorous checks for these signatures in earlier versions created an opening where attackers could manipulate the token structure without possessing valid credentials.
Under specific operational conditions, an authenticated user with lower-level privileges was able to construct and submit a JWT that lacked a digital signature. Because the application failed to strictly enforce signature validation on incoming tokens during certain administrative operations or session management processes, it accepted this unsigned token as legitimate. Consequently, the system granted the requester cloudadmin permissions, which constitute the highest level of access within the Ivanti Secret Server architecture. This effectively bypasses standard authentication and authorization controls, allowing a low-privileged user to assume the role of an administrator without providing valid credentials or passing through multi-factor authentication checks.
The operational impact of this vulnerability is severe due to the nature of cloudadmin privileges in secret management platforms. These permissions typically allow full control over secrets storage, including viewing sensitive passwords and API keys, modifying access policies, managing user accounts, and potentially executing administrative commands that interact with connected systems. An attacker exploiting this flaw could exfiltrate highly confidential data, create backdoor accounts for persistent access, or disrupt service availability by altering critical configurations. The ability to escalate privileges silently makes detection difficult through standard logging mechanisms unless specific anomaly detection is in place regarding token validation failures and subsequent privilege changes.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system failed to verify the identity of the user claiming administrative rights via the JWT mechanism. It also relates closely to CWE-345 Insufficient Verification of Data Authenticity, highlighting the failure to validate the cryptographic signature that guarantees token integrity. In terms of adversary tactics, this exploitation technique maps to MITRE ATT&CK techniques such as T1078 Valid Accounts and T1098 Manipulated Authentication Credentials, where an attacker leverages or alters authentication artifacts to gain unauthorized access. The scenario specifically illustrates how weak input validation on security tokens can lead to complete compromise of the application's trust model.
Mitigation for this issue requires immediate upgrading to Ivanti Secret Server version 12.3.1 or later, which includes patches that enforce strict signature verification for all JWTs regardless of context. Organizations should also implement defense-in-depth strategies by monitoring for unusual authentication patterns, such as rapid privilege escalations following token submission events. Additionally, ensuring that web application firewalls are configured to detect malformed or unsigned tokens can provide an additional layer of protection against exploitation attempts while patching is being applied across the infrastructure. Regular audits of access logs and enforcement of least-privilege principles further reduce the blast radius should such vulnerabilities be present in other components of the environment.