CVE-2026-19117: FIDO2 Authentication Bypass Vulnerability

CVE-2026-19117 Overview

CVE-2026-19117 is an authentication bypass vulnerability affecting on-premises Delinea deployments. Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target user account. Once registered, the attacker authenticates as that user without further interaction. The flaw maps to [CWE-290] Authentication Bypass by Spoofing and is exploitable over the network without prior privileges or user interaction.

Critical Impact
An unauthenticated remote attacker can fully impersonate a valid user account by binding a rogue FIDO2 authenticator, resulting in complete confidentiality, integrity, and availability compromise of the affected identity.

Affected Products

Delinea on-premises deployments (cloud/SaaS deployments are not affected per vendor advisory)
Products relying on the affected FIDO2 registration flow
See Delinea Security Advisories for the definitive product and version list

Discovery Timeline

2026-09-02 - CVE-2026-19117 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19117

Vulnerability Analysis

The vulnerability resides in the FIDO2 credential registration path used by on-premises Delinea deployments. FIDO2 (Fast Identity Online 2) binds a public key credential to a specific user account during an enrollment ceremony. If the registration flow does not correctly bind the enrollment session to the authenticated identity, an attacker can enroll a credential they control against another user's account. The vulnerability is classified as [CWE-290] Authentication Bypass by Spoofing because the resulting authentication is legitimate from the server's perspective while the identity claim is forged.

Successful exploitation lets the attacker log in as the victim through the normal WebAuthn/FIDO2 assertion path. Any downstream service that trusts the identity provider inherits the impersonation. In privileged access management (PAM) deployments, this can extend to secrets, sessions, and administrative consoles.

Root Cause

The root cause is improper association between the registration ceremony and the target user account. Under the specific conditions referenced in the vendor advisory, the server accepts a credential registration request without verifying that the requester is authorized to bind a new authenticator to the specified account.

Attack Vector

The attack is executed over the network against the on-premises FIDO2 registration endpoint. The attacker submits a registration request that ties an authenticator under their control to the victim's account, then invokes the standard FIDO2 authentication endpoint. No user interaction or prior credentials are required. Refer to the Delinea Security Advisories page for exploitation preconditions.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose without synthetic exploit code.

Detection Methods for CVE-2026-19117

Indicators of Compromise

FIDO2 credential registration events for user accounts that did not initiate enrollment through a legitimate self-service or administrative workflow
Successful authentications immediately preceded by a new authenticator registration from an unfamiliar source IP or user agent
Multiple authenticators registered to the same account within a short window, particularly for privileged accounts

Detection Strategies

Correlate FIDO2 registration events with the authenticated session that initiated them; alert when the initiating session identity differs from the target account
Baseline authenticator enrollment volume per user and flag statistical outliers
Monitor administrative and PAM accounts for any new WebAuthn credential registration

Monitoring Recommendations

Ingest Delinea audit logs into a centralized SIEM and retain authentication and enrollment events for forensic review
Alert on FIDO2 registration API calls originating from IP ranges outside the corporate network
Review logs retroactively for unauthorized credential enrollments predating patch deployment

How to Mitigate CVE-2026-19117

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Delinea Security Advisories as the primary remediation
Audit all FIDO2 credentials registered to user accounts, prioritizing administrative and service-tier identities
Remove any unrecognized authenticators and force re-enrollment through a verified, in-person or step-up authenticated workflow
Rotate secrets and session tokens associated with any account showing suspicious enrollment activity

Patch Information

Consult the Delinea Security Advisories portal for the fixed product versions and upgrade guidance. On-premises deployments must be updated by the customer; cloud-hosted deployments are not affected.

Workarounds

Restrict access to the FIDO2 registration endpoint to trusted networks or VPN only, if feasible pending patch deployment
Require step-up authentication or administrative approval for all new authenticator enrollments
Temporarily disable self-service FIDO2 registration until patched versions are deployed

bash

# Example: restrict FIDO2 registration endpoint to internal networks (reverse proxy)
# Replace paths and CIDR ranges with values appropriate for your deployment
location /fido2/register {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://delinea_backend;
}