CVE-2026-15640

CVE-2026-15640 is a critical (CVSS 4.0: 9.5) authentication bypass flaw (CWE-290) in Delinea Secret Server in which, under certain conditions, a valid SAML Identity Provider response can be used to impersonate another Secret Server user. An attacker with a legitimate SAML response for their own account (or the ability to influence how the response is processed) could authenticate as a different user of the privileged access management platform, potentially gaining access to that user's stored secrets, credentials, and privileged accounts. Exploitation is network-based but has high attack complexity and requires attacker prerequisites, suggesting specific SAML configuration or assertion conditions must be met. The flaw affects organizations deploying Delinea Secret Server with SAML single sign-on enabled; the specific affected versions were not stated in the available data. There is no known public proof of concept and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed in-the-wild exploitation at this time.

What to do: Apply the vendor's patched Secret Server release as soon as Delinea publishes the fixed version, prioritizing instances with SAML SSO enabled. Review authentication and audit logs for SAML logins where the authenticated identity does not match the asserted NameID, and validate SAML claim/NameID mapping configuration against vendor guidance. Until patched, consider increasing monitoring on SAML-authenticated sessions or temporarily restricting SAML SSO for high-privilege accounts.