{"cve":"CVE-2025-12810","nvd":{"published":"2026-01-27T20:16:14.320","modified":"2026-06-17T08:32:59.163","status":"Analyzed","description":"Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25.\n\nA secret with \"change password on check in\" enabled automatically checks in even when the password change fails after reaching its retry limit.  This leaves the secret in an inconsistent state with the wrong password.\n\nRemediation: Upgrade to 11.9.47 or later. The secret will remain checked out when the password change fails.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:A","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5},"cwes":["CWE-287"],"references":["https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-9-000047.htm","https://trust.delinea.com/?tcuUid=48260de9-954d-45c2-9c66-2c9510798a0b","https://trust.delinea.com/"],"products":["delinea:secret_server"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2025-12810","score":0.00463,"percentile":0.40183,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}