The vulnerability is an improper authentication flaw that allows a user to submit an unsigned JSON Web Token to Secret Server and obtain cloud administration rights. This flaw, categorized as CWE-863, enables an attacker to falsely assert elevated privileges and gain control over cloud resources, potentially compromising confidentiality, integrity, and availability. The impact is a full privilege escalation within the Secret Server environment.

The flaw affects the Delinea Secret Server product. Any installation running a version earlier than 12.3.1 remains susceptible. The advisory specifically mentions all prior releases before version 12.3.1.

The CVSS score of 8.7 indicates a High severity vulnerability. Because the EPSS score is not available, the probability of exploitation cannot be quantified, but the lack of a KEV listing suggests it has not yet been observed in the wild. Exploitation likely requires the attacker to be able to send a crafted JWT to the server, which can be performed remotely via the web interface if the user is authenticated, or potentially unauthenticated if the token endpoint is exposed. The attack path leverages the server's failure to validate token signatures, allowing a privilege escalation to cloudadmin controls.