An application I am looking to use is using DPAPI to encrypt a Client Secret as part of a OAuth2 Authentication flow. A domain service account will be used for encryption with the password stored in CyberArk.
I am trying to understand how someone can decrypt the Client Secret. Based on research I've done a malicious actor will need to get the password for the service account and then use a 3rd party tool (such as DataProtectionDecryptor by NirSoft) to decrypt the Client Secret.
Is my understanding correct? Does DPAPI become useless once the password to the service account in this instance is known?