CVE-2026-76383: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk RSA SecurID Authentication Manager app for Splunk SOAR

In the RSA SecurID Authentication Manager app for Splunk SOAR versions >=1.0 and <1.0.5, a user with action execution permissions can see sensitive token serials in cleartext in the UI when using the enable token or revoke token actions. The root cause is that the token_serial parameter is not marked as a password, so it is not masked, allowing exposure of sensitive information to authorized users who might not need to see it.

The vulnerability allows disclosure of sensitive token serial information to users with permissions to run actions in the app. This could lead to unauthorized knowledge of token serials, potentially weakening security controls that rely on token secrecy. However, the impact is limited to information disclosure (confidentiality) without integrity or availability effects.

A fix is available in version 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR. Users should upgrade to version 1.0.5 or later to ensure the token_serial parameter is properly masked. No other mitigation steps are indicated by the vendor advisory.