CVE-2024-25651: Delinea PAM Secret Server · Observable Discrepancy
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 14 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-25651, organizations should implement the following specific measures: 1) Restrict access to the /oauth2/token endpoint by enforcing network-level controls such as IP whitelisting or VPN-only access to limit exposure to trusted users and systems. 2) Implement rate limiting and anomaly detection on authentication endpoints to detect and block automated enumeration attempts. 3) Standardize error messages and response codes from authentication APIs to avoid revealing whether a username exists, ensuring consistent responses regardless of input validity. 4) Monitor authentication logs for unusual patterns indicative of user enumeration, such as repeated failed attempts with different usernames from the same source. 5) Stay informed about vendor advisories and apply patches or updates promptly once available from Delinea. 6) Consider deploying Web Application Firewalls (WAFs) with rules designed to detect and block enumeration techniques targeting authentication endpoints. 7) Educate security teams about this vulnerability to enhance incident response readiness. These targeted actions go beyond generic advice by focusing on reducing information leakage and detecting enumeration attempts specifically in the context of Delinea PAM Secret Server.
Description
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.