EUVD-2026-89025
GHSA-77jc-98pv-xc56
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
DB read access is required (PR:H) and the vector is data-tier/local (AV:L); cleartext data needs no special conditions to read (AC:L); C:H for token disclosure, I:L only via downstream session replay enabling the S:C impersonation scope.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
5DescriptionCVE.org
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.
AnalysisAI
Cleartext storage of external identity provider tokens and active session identifiers in the Devolutions Server backend database means anyone who already holds read access to those records can recover reusable credentials and replay them to impersonate users. The affected code is Devolutions Server 2026.3.5.0 and earlier; ENISA's EUVD entry narrows the affected range to all Server builds below 2026.3.7.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires pre-existing read access to the Devolutions Server backend database (PR:H, AV:L) - for example compromised database credentials, a database backup, a separate injection flaw, or a malicious/privileged DBA. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-urgency issue whose risk is heavily gated by its prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Devolutions Server 2026.3.7.0 is the first fixed release identified in the ENISA EUVD affected range ("Server 0 < 2026.3.7.0"), and patch availability is confirmed by the vendor; upgrade to 2026.3.7.0 or later following the instructions in advisory DEVO-2026-0034 (https://devolutions.net/security/advisories/DEVO-2026-0034/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Devolutions Server instances and identify any running version 2026.3.5.0 or earlier (or per ENISA, any build below 2026.3.7.0); apply vendor-released patch 2026.3.7.0 immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today