Secret Server partial login bypass

Summary

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.

Remediation

1. Inventory every Delinea Secret Server deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://delinea.com/security-advisories