In Secret Server versions earlier than 12.3.1, the authentication flow failed to enforce PIN or biometric verification when a user attempted to authenticate using a FIDO2‑compliant device. This allows an attacker with a valid FIDO2 token to bypass the required secondary credential, effectively authenticating as the target user without the PIN or biometric input. The weakness maps to CWE‑284, reflecting an improper authorization flaw.

The vendor is Delinea and the product is Secret Server. All releases below version 12.3.1 are vulnerable. The impact applies to deployments that rely on FIDO2 token authentication.

The CVSS base score of 5.1 indicates moderate severity. Because the exploit requires possession of a legitimate FIDO2 token and the ability to target the authentication endpoint, it is publicly exploitable over the network. No EPSS data is available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. Assuming a remote attacker can obtain a compromised or stolen FIDO2 device, the attack path would involve a login attempt that succeeds without PIN or biometric confirmation, providing unauthorized access to the Secret Server account.