CVE-2026-76383 in RSA SecurID Authentication Manager App for SOAR
Summary
by MITRE • 08/19/2026
In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The RSA SecurID Authentication Manager app for Splunk SOAR, specifically in versions prior to 1.0.5, contains a significant information disclosure vulnerability that stems from improper handling of sensitive authentication data within the application's user interface. This flaw affects users who possess roles with permissions to execute specific actions related to token management. The core technical issue lies in the configuration of action parameters where critical security identifiers are not adequately protected against exposure. Specifically, when an authorized user invokes either the enable token or revoke token action, the system fails to mask the value provided for the token_serial parameter. Instead of displaying masked characters such as asterisks or dots which would obscure the actual data, the interface renders this sensitive identifier in cleartext directly within the UI elements visible to the operator and potentially logged in browser history or network traffic depending on implementation details.
This vulnerability represents a classic case of improper input validation combined with insufficient output encoding for security-sensitive fields. The root cause is identified as the application not marking the token_serial parameter with the appropriate attribute that signals it should be treated as a password field by the Splunk SOAR framework. In standard software engineering practices, any field containing secrets, credentials, or sensitive identifiers must be explicitly flagged to ensure consistent masking behavior across all interfaces including web forms and command-line executions. By omitting this designation, the application defaults to treating the input as plain text, thereby bypassing built-in security controls designed to prevent accidental exposure of high-value assets like RSA SecurID token serial numbers which are often used in conjunction with PINs for multi-factor authentication.
The operational impact of this vulnerability is substantial from a risk management perspective because it facilitates unauthorized information gathering that can aid further attacks against the organization's identity infrastructure. An insider threat actor or an attacker who has compromised a user account with sufficient privileges to run these actions could easily capture the token serial numbers displayed on screen. These serial numbers are unique identifiers for hardware tokens and, when combined with other potentially leaked data such as PINs obtained through phishing or shoulder surfing, can lead to full compromise of two-factor authentication mechanisms. This undermines the security posture provided by RSA SecurID and exposes users to account takeover attacks even if their passwords remain secure.
From a classification standpoint, this vulnerability aligns closely with CWE-200 which defines Exposure of Sensitive Information to an Unauthorized Actor. It also relates to CWE-532 regarding Insertion of Sensitive Information into Log Files if the cleartext serial is logged during action execution. Furthermore, in the context of the MITRE ATT&CK framework, this behavior supports reconnaissance activities where adversaries seek to gather information about security configurations and credentials to facilitate lateral movement or privilege escalation. The lack of masking constitutes a failure in implementing proper access control mechanisms for sensitive data presentation, which falls under broader categories of insufficient protection against unauthorized disclosure.
To mitigate this vulnerability, organizations running affected versions must immediately upgrade the RSA SecurID Authentication Manager app for Splunk SOAR to version 1.0.5 or later where these parameter masking issues have been resolved by developers. Until an update is applied, administrators should enforce strict role-based access controls limiting who can invoke token management actions and monitor logs for unusual activity patterns involving enable or revoke operations. Additionally, security teams should review existing playbooks and automation scripts to ensure that any custom integrations do not inadvertently expose these serial numbers in external logging systems or dashboards. Regular audits of application configurations against industry standards such as NIST SP 800-63B for digital identity guidelines can help identify similar misconfigurations across other integrated security tools within the SOAR environment ensuring comprehensive protection of authentication assets.