# CVE-2026-115830: Delinea Secret Server unsigned JWT authentication bypass

Source: https://junglewise.ai/threats/cve-2026-115830-in-secret-server-versions-earlier-than-12-3-1-a-user-under  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-115830 · Severity: info · Published 2026-10-30

Secret Server is a privileged credential vault used to secure and manage passwords across enterprise systems. Under certain conditions, an attacker could submit an unsigned JWT token to gain cloudadmin permissions, allowing unauthorized access to the most sensitive credentials and administrative functions in the vault.

Technologies: [Delinea Secret Server](https://junglewise.ai/threats/technologies/secret-server). Vendors: [Delinea](https://junglewise.ai/threats/vendors/delinea).

## Quick answers

**Is CVE-2026-115830 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115830 being exploited in the wild.

**How severe is CVE-2026-115830?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Delinea Secret Server earlier than 12.3.1.

**Is there a fix for CVE-2026-115830?** Yes: fixed in 12.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115830 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115830?** Check whether you run Delinea Secret Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 12.3.1

## Technical details

The vulnerability allows a user to submit an unsigned JWT (JSON Web Token) and receive elevated cloudadmin permissions in response, bypassing JWT signature validation. This is an authentication bypass affecting Secret Server's token validation logic. The attack requires specific conditions to be met but results in privilege escalation to the highest administrative level.

## Affected products

- Delinea Secret Server earlier than 12.3.1

## Timeline

- 2026-10-30: advisory

## References

- [https://delinea.com/security-advisories](https://delinea.com/security-advisories)

## Related threats

- [Delinea Secret Server authentication bypass via second factor](https://junglewise.ai/threats/cve-2026-115829-in-secret-server-versions-earlier-than-12-3-1-a-user-could)
- [Delinea Secret Server FIDO2 PIN/biometric validation bypass](https://junglewise.ai/threats/cve-2026-115828-in-secret-server-versions-earlier-than-12-3-1-secret-server-did)
- [Delinea Secret Server SAML identity spoofing](https://junglewise.ai/threats/cve-2026-15640-delinea-secret-server-saml-identity-spoofing)
- [Delinea Secret Server padding oracle vulnerability](https://junglewise.ai/threats/cve-2026-15638-delinea-secret-server-padding-oracle-vulnerability)
- [Delinea FIDO2 credential registration authentication bypass](https://junglewise.ai/threats/cve-2026-19117-delinea-fido2-credential-registration-authentication-bypass)