CVE-2026-15640

CriticalCVSS 9.5/10Last modified Sep 18, 2026

Description

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

Metrics

CVSS 4.0 9.5/10CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DelineaSecret Server (On-Prem)>= 10.5.0, <= 12.1.3

References

Timeline

Published
Sep 16, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-156417.1Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privilegCVE-2026-156423.3Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.CVE-2026-156437.3AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWSCVE-2026-156446.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode AttriCVE-2026-156456.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode AttribuCVE-2026-156466.4The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versionsCVE-2026-156474.4The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all vCVE-2026-156486.4The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versionsCVE-2026-156496.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes inCVE-2026-15658.8The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable tCVE-2026-156506.4The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointeCVE-2026-156514.9The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all version
CVE-2026-15640: Critical severity, CVSS 9.5 | Vulnix