Spoofing the Second Factor: Analyzing FIDO2 Credential Registration Bypass in Delinea Secret Server (CVE-2026-19117)
Executive Summary
A critical vulnerability in Delinea Secret Server's FIDO2 credential registration mechanism allows threat actors to register fraudulent authenticators to legitimate user accounts without valid authentication factors, bypassing second-factor authentication controls and establishing durable, undetected access to enterprise secrets management infrastructure. CVE-2026-19117 (CVSS 9.8) affects all pre-patch versions of Secret Server deployed across cloud and on-premises environments.
The vulnerability operates at the foundational authentication layer; compromise enables attackers to access downstream organizational secrets (database credentials, API keys, cloud service authentication tokens) and cascade compromise across dependent systems. Organizations must treat this as an authentication infrastructure emergency requiring immediate inventory, enhanced monitoring, and rapid patching.
Immediate actionable guidance: The exposure window between public disclosure and full organizational remediation is estimated at 30–60 days, during which active exploitation attempts are documented. Immediate action: Initiate Secret Server inventory, activate FIDO2 registration audit logging, and stage patched versions in isolated test environments within 24 hours.
Key Finding: CVE-2026-19117 permits unauthenticated or insufficiently-authenticated FIDO2 credential registration, allowing threat actors to register attacker-controlled authenticators to victim accounts without possession of valid authentication factors, thereby circumventing multi-factor authentication controls and establishing durable account compromise vectors.
What Happened
In September 2026, a critical authentication bypass vulnerability was disclosed in Delinea Secret Server affecting the FIDO2 credential registration mechanism. The vulnerability stems from insufficient authentication state validation during the credential enrollment process. When users or administrators attempt to register a new FIDO2 authenticator (such as a hardware security key, Windows Hello credential, or mobile biometric authenticator), Secret Server's registration endpoint fails to properly verify the requestor's identity or session legitimacy before accepting the credential binding.
The technical mechanism operates as follows: Proper FIDO2 credential registration requires the user to first authenticate using an existing authentication factor (password, existing FIDO2 credential, or other MFA method), then complete a cryptographic challenge-response exchange specific to that user's identity. CVE-2026-19117 permits attackers to register credentials without satisfying the initial authentication requirement. Additionally, the registration challenge is not adequately bound to a specific user identity or session, allowing credential binding to arbitrary accounts.
This creates a credential substitution attack: an attacker can register an attacker-controlled FIDO2 authenticator to a victim's Secret Server account without possessing valid credentials or access to the victim's existing authenticators. Once successfully registered, the attacker can use their fraudulent authenticator to authenticate to the compromised account indefinitely, gaining full access to the secrets management platform and all downstream credentials stored within it.
The vulnerability affects both cloud-hosted Secret Server instances and on-premises deployments. The attack surface is the FIDO2 registration endpoint itself, exposed over the network via HTTP/HTTPS. Authentication requirements are minimal or absent, making exploitation complexity low and accessible to threat actors with basic network-level access.
Delinea was notified of the vulnerability and coordinated a disclosure timeline. CVE-2026-19117 was formally assigned with a CVSS 3.1 score of 9.8 (CRITICAL), reflecting network accessibility, low exploitation complexity, absence of privilege requirements, and high impact on confidentiality, integrity, and availability. Patched versions were released concurrently with vulnerability disclosure.
Post-disclosure, security researchers and threat intelligence organizations documented active exploitation attempts against exposed Secret Server instances, confirming rapid weaponization by threat actors. The exposure window—the period between public disclosure and organizational patch deployment—represents critical risk. Industry patterns indicate that full remediation across enterprise organizations typically requires 30–60 days due to testing requirements, change management procedures, and production patching windows. During this interval, organizations operating unpatched Secret Server instances face direct account takeover and secrets exfiltration.
Why It Matters
Identity and Access Management Practitioners
The FIDO2 credential registration bypass strikes at a foundational assumption underlying passwordless authentication: that FIDO2 credentials are cryptographically resistant to unauthorized registration and impersonation. This vulnerability disrupts the security model of passwordless migration initiatives. Organizations that have prioritized FIDO2 deployment as a 'stronger' second factor or primary authentication method must re-evaluate control effectiveness. The distinction between the FIDO2 standard (W3C WebAuthn-3) and Secret Server's implementation is critical: the standard defines robust security properties, but implementation failure nullifies those properties in practice. IAM teams must immediately audit enrollment processes, identify potentially compromised credentials, and re-implement registration controls with mandatory pre-enrollment authentication and identity verification.
Security Architects and Infrastructure Leaders
Secret Server functions as a foundational secrets management platform for enterprise infrastructure. Compromise cascades to all dependent systems relying on managed credentials. A threat actor with access to a compromised Secret Server account can exfiltrate database credentials, API authentication tokens, cloud service credentials, SSH keys, and other high-value secrets. This blast radius extends across applications, databases, cloud platforms, and third-party integrations. For architects, the vulnerability underscores a critical principle: stronger authentication factors (FIDO2) do not eliminate the need for continuous access verification, microsegmentation, and secrets rotation. Organizations that assumed passwordless authentication would resolve authentication risks must implement additional compensating controls such as behavioral analytics, secrets access auditing, and secrets rotation independent of authentication mechanisms.
Security Leadership and Chief Information Security Officers
CVE-2026-19117 represents a single-vendor, single-point-of-failure risk in critical IAM infrastructure. Organizations relying on a single Secret Server instance for all enterprise credential management face organization-wide exposure. Additionally, the vulnerability has direct compliance implications. Organizations cannot assert that MFA controls are effective while an unpatched, exploitable authentication bypass exists. Compliance frameworks (SOC 2, ISO 27001, PCI-DSS, HIPAA) require effective access control validation; this vulnerability directly contradicts such certifications. Leadership must assess third-party vendor vulnerability disclosure responsiveness, patch availability and velocity, and whether organizational redundancy or diversification of secrets management solutions is warranted.
Compliance and Risk Management Teams
The vulnerability creates immediate compliance violations in organizations operating unpatched Secret Server instances. Regulations and frameworks requiring multi-factor authentication assume the MFA implementation actually prevents unauthorized access; a registration bypass negates this assumption. Risk registers must be updated to reflect compromised control status. Customer-facing compliance certifications may require suspension or revision during the exposure window. Third-party and vendor access management is directly affected: if Secret Server manages third-party credentials, those credentials are exposed to compromise alongside internal secrets. Incident response and forensic investigation capabilities must be prepared for account compromise investigation.
Cloud Infrastructure Operators
Organizations operating Secret Server in cloud environments (AWS, Azure, Google Cloud) must immediately assess their cloud-hosted instances. Cloud-native security assumptions (network isolation, identity-based access controls) do not protect against application-layer authentication bypasses. Cloud operators must verify current instance exposure, whether FIDO2 registration has been exercised in their environment, and whether cloud-native logging and monitoring can detect vulnerability exploitation.
Operational Implications
Detection Complexity and Silent Compromise: The primary operational challenge is that compromised FIDO2 credentials are functionally identical to legitimate credentials. An attacker using a fraudulently-registered authenticator will present cryptographically-valid FIDO2 responses indistinguishable from legitimate user authenticators. Standard authentication logs record successful authentication events without indicating the authenticator is malicious. This creates a silent compromise scenario where unauthorized access occurs without triggering authentication failure alerts or lockout mechanisms. Detection requires examining FIDO2 registration logs, not authentication logs. Indicators of compromise include: FIDO2 credential registrations outside normal administrative maintenance windows; multiple FIDO2 credentials registered to the same account in short timeframes; registration requests from geographic locations inconsistent with user activity patterns; registrations originating from IP addresses associated with malicious actors or VPN services; credential registrations immediately followed by secrets access or account activity. Legitimate users may register multiple FIDO2 credentials (office security key, mobile biometric authenticator). Distinguishing malicious registrations from legitimate user behavior requires behavioral context, which many organizations lack for secrets management platforms.
Patching and Deployment Complexity: Secret Server operates as critical authentication infrastructure; downtime during patching cascades to dependent systems. Organizations must balance rapid remediation against service availability. Patching strategies must account for: dependency mapping identifying systems and applications depending on Secret Server credentials that cannot tolerate outage; high-availability validation ensuring patched versions maintain failover and redundancy capabilities; credential refresh timing coordinating secret rotation during patching with dependent system updates; rollback preparedness maintaining procedures in case patched versions introduce incompatibilities or new issues. Post-patch security validation requires comprehensive re-authentication of all FIDO2-registered credentials. Simply deploying the patch does not automatically remove fraudulently-registered authenticators. Organizations must identify and revoke potentially malicious registrations, then force re-enrollment under controlled conditions.
Forensic Investigation Requirements: If unauthorized credential registrations are suspected or confirmed, incident response teams must investigate: timeline reconstruction to determine when fraudulent credentials were registered and when they were used to access Secret Server; secrets exfiltration assessment identifying which secrets were accessed through compromised accounts and assuming exfiltration unless proven otherwise; cascade compromise validation assessing whether dependent systems were compromised (database breach, API abuse, cloud service compromise) for each secret accessed; lateral movement analysis determining whether compromise of Secret Server was the entry point for broader network compromise or represents isolated credential theft. This investigation scope is substantial and requires deep audit log analysis, authenticator forensics, and dependent system investigation. Many organizations lack forensic capabilities for authentication infrastructure and will require external incident response support.
Compliance Impact During Exposure Window: During the pre-patch exposure window, organizations cannot certify that MFA controls are effective. This creates immediate compliance gaps for: SOC 2 Type II audits (access control effectiveness certifications); regulatory audits (PCI-DSS, HIPAA, FedRAMP); customer attestations (cloud service providers certifying access control effectiveness); breach notification determinations (in some jurisdictions, exploitation may trigger notification requirements).
Third-Party and Customer Impact: If Secret Server manages credentials for third-party access (vendors, partners, outsourced services), platform compromise compromises third-party access assurance. Organizations may face contractual obligations to notify partners of potential credential exposure. Customer-facing cloud service providers may experience customer pressure to suspend operations or migrate to alternative providers during remediation.
Recommended Actions
Actions are organized by organizational security maturity. Baseline controls apply across all tiers and should be treated as immediate priorities regardless of organizational size.
* Critical immediate actions to establish inventory, monitoring, and investigation foundation.
- 1 - Identify all Secret Server deployments within your organizational footprint, including cloud-hosted instances (AWS, Azure, Google Cloud), on-premises installations (virtual machines, physical servers), and secondary or disaster recovery instances
- 2 - Document for each instance: version number and current patch status, number of FIDO2-enrolled user accounts, dependent systems and applications relying on managed secrets, network accessibility (internet-facing vs. internal network only), and backup and recovery capabilities
- 3 - Create a remediation priority list based on number of FIDO2-enrolled accounts, criticality of dependent systems, and whether instance is internet-facing or internal
- 4 - Configure detailed audit logging on all Secret Server FIDO2 registration and authentication endpoints, including timestamp, source IP address, target user account, registration outcome, and authenticator type
- 5 - Configure alerting for multiple FIDO2 registrations to the same account within 24 hours, registrations outside normal business hours, registrations from geographic locations inconsistent with user baseline, registrations from IP addresses in threat intelligence feeds or known VPN services, and successful authentication using FIDO2 credentials registered within 72 hours
- 6 - Forward audit logs to a centralized SIEM for correlation and long-term retention; ensure logs are immutable and tamper-evident
- 7 - Begin systematic review of all FIDO2-enrolled credentials, documenting for each credential: account owner, registration timestamp and source IP address, authenticator characteristics (device model, serial number, public key fingerprint if available), and last used timestamp and access patterns
- 8 - Cross-reference credential registration events with Active Directory login history, VPN or remote access logs, and email and calendar systems to verify user was working during registration
- 9 - Prioritize investigation of credentials registered outside normal business hours, from geographic locations inconsistent with user baseline, from IP addresses on threat intelligence lists, and to high-privilege accounts (administrators, service accounts, system accounts)
- 10 - Alert business unit owners, application teams, and infrastructure operators of CVE-2026-19117 and expected patching timeline
- 11 - Establish communication cadence for daily remediation status updates during acute exposure period, expected service impact and maintenance windows, dependencies requiring advance coordination, and incident response contact escalation procedures
- 12 - Prepare customer-facing communication regarding access control assurance and remediation timeline if applicable
* Detailed investigation, credential management, and pre-patching validation.
- 1 - For Secret Server accounts with FIDO2 credentials, correlate authentication logs with system activity to identify potential unauthorized access spanning the preceding 30 days
- 2 - Cross-reference authentication events using FIDO2 credentials with application access logs (API calls, secret retrieval events, administrative actions) to identify access patterns deviating from user baseline
- 3 - Flag access patterns deviating from baseline including off-hours access, access from geographic locations outside user baseline, access to secrets outside user's normal business function, bulk secret retrieval or export operations, and administrative actions (account creation, credential rotation, access control modification)
- 4 - Develop a phased credential revocation strategy: Phase 1 (High-Risk) revoke FIDO2 credentials registered to high-privilege accounts or flagged as potentially malicious; Phase 2 (Medium-Risk) revoke credentials registered from elevated-risk geographic locations or time windows; Phase 3 (Remediation Confirmation) after patching is complete and no additional compromise indicators emerge, re-enroll legitimate credentials under supervised conditions
- 5 - Establish a re-enrollment process requiring users authenticate using existing non-FIDO2 methods (password or existing MFA) and register new FIDO2 credentials in supervised environments (in-person with IT or within controlled administrative window)
- 6 - Prepare audit trail of re-enrollment with administrator approval documentation
- 7 - Prepare communication to affected users explaining credential revocation, requesting re-enrollment, and providing step-by-step guidance
- 8 - Obtain patched Secret Server versions from Delinea and deploy to an isolated test environment matching production configuration (same operating system, database platform, and network architecture)
- 9 - Deploy realistic data volume and user accounts to test environment; include FIDO2 authenticators for testing if available
- 10 - Validate that FIDO2 credential registration enforces proper authentication and identity verification post-patch
- 11 - Validate that malicious registration requests are properly rejected
- 12 - Validate that existing legitimate FIDO2 credentials continue to function post-patch
- 13 - Validate that all dependent system integrations remain functional
- 14 - Validate that performance and availability characteristics meet requirements
- 15 - Ensure rollback procedures are documented and functional
- 16 - Document any issues, compatibility concerns, or performance considerations for patching teams
* Production patching, incident response, and post-remediation governance hardening.
- 1 - Deploy patched Secret Server versions to production environments according to change management procedures, coordinating with business units and infrastructure teams to schedule maintenance windows minimizing service impact
- 2 - For each production deployment, execute backup and snapshot procedures prior to patching
- 3 - Deploy patch to primary instance and validate authentication functionality and FIDO2 registration controls with test accounts
- 4 - Monitor for errors, performance degradation, or dependent system failures following primary instance patching
- 5 - Patch secondary, disaster recovery, or geographically-distributed instances following successful primary patching
- 6 - Document patching completion and validation results
- 7 - Maintain enhanced monitoring during and 48 hours after patching to detect authentication anomalies
- 8 - If unauthorized FIDO2 credential registrations are identified during investigation, assume full account compromise and initiate credential reset
- 9 - Force password reset and mandatory MFA re-enrollment for compromised accounts
- 10 - Revoke all active sessions to the compromised account
- 11 - Extend forensic investigation to all systems accessed via the compromised Secret Server account
- 12 - Rotate all secrets accessed by the compromised account (assume potential exfiltration or modification)
- 13 - Immediately update dependent systems and applications to use new credentials
- 14 - Coordinate with dependent application owners to validate continued functionality post-rotation
- 15 - Assess whether any downstream systems show indicators of compromise (unauthorized access, anomalous activity) following Secret Server compromise
- 16 - Execute third-party penetration testing of patched Secret Server FIDO2 registration endpoint to validate vulnerability remediation, or internal security testing if external resources are unavailable
- 17 - Update IAM policies and procedures to require FIDO2 credential registration only under supervised conditions (in-person or within controlled administrative windows)
- 18 - Require pre-registration authentication and identity verification for all FIDO2 registrations
- 19 - Establish periodic FIDO2 credential audits (minimum monthly)
- 20 - Configure alerts for anomalous credential registration patterns
- 21 - Establish incident response procedures specific to secrets manager compromise (investigation playbooks, forensic procedures)
- 22 - Update risk registers and compliance documentation to reflect control remediation, residual risk, and compensating controls
- 23 - Schedule training for security operations center personnel on FIDO2 forensics and anomalous authentication pattern detection
Closing Statement
CVE-2026-19117 exemplifies a critical risk category that organizations often underestimate: authentication infrastructure vulnerabilities enabling silent, undetectable account compromise. The assumption that passwordless authentication is more secure is valid only when registration and enrollment processes enforce proper identity verification and authentication state validation. This vulnerability demonstrates that vendor implementation failures can nullify the security properties of cryptographically-sound standards.
The institutional significance extends beyond this immediate vulnerability. Organizations implementing secrets management and passwordless authentication must distinguish between standard-level security properties and implementation-level security properties. A FIDO2 registration bypass is an implementation failure, not a standard weakness, but the impact is identical: compromised authentication. Forward-looking security strategies must assume any single authentication mechanism can be compromised and design layered, continuous verification approaches that do not depend on any single factor. This includes periodic secrets rotation independent of authentication mechanisms, behavioral analytics to detect unauthorized access, and secrets access auditing operating independently of the secrets manager itself.
The remediation window of 30 to 60 days represents a period of elevated institutional risk demanding rigorous attention, prioritized patching, and enhanced monitoring. Organizations treating this as a routine vulnerability update rather than an authentication infrastructure emergency will likely experience unauthorized access during this window. Those executing the tiered recommendations with appropriate urgency can substantially reduce exposure and contain exploitation impact.