Secret Server JWT issuance error

Summary

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

Remediation

1. Inventory every Delinea Secret Server deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://delinea.com/security-advisories