Splunk RSA SecurID Authentication Manager App for SOAR up to 1.0.4 User Interface token_serial missing encryption

Summaryinfo

A vulnerability marked as problematic has been reported in Splunk RSA SecurID Authentication Manager App for SOAR up to 1.0.4. Affected by this issue is some unknown functionality of the component User Interface. Performing a manipulation of the argument token_serial results in missing encryption. This vulnerability is reported as CVE-2026-76383. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Splunk RSA SecurID Authentication Manager App for SOAR up to 1.0.4. This affects an unknown code of the component User Interface. The manipulation of the argument token_serial with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. The summary by CVE is:

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

The advisory is shared at advisory.splunk.com. This vulnerability is uniquely identified as CVE-2026-76383 since 08/19/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 1.0.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• RSA SecurID Authentication Manager App for SOAR

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion