What is the CVSS score of CVE-2026-12162?

CVE-2026-12162 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Remote Desktop Manager CVE-2026-12162

EUVD-2026-37024 MEDIUM

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-06-15 DEVOLUTIONS

GHSA-xwf9-wf96-c767

Information Disclosure Remote Desktop Manager

5.5

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

5.7 MEDIUM

Credential disclosure warrants C:H; description confirms no integrity or availability impact; PR:L for entry-creation access; UI:R for required victim interaction.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 13:27 vuln.today

CVSS changed

Jun 16, 2026 - 13:22 NVD

5.5 (MEDIUM)

CVE Published

Jun 15, 2026 - 23:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

AnalysisAI

Credential disclosure in Devolutions Remote Desktop Manager versions 2026.2.0 through 2026.2.8 allows a low-privileged attacker to capture stored social login credentials by creating a crafted web entry targeting a provider lookalike domain. The social login autofill feature fails to properly validate the target host against the legitimate OAuth or social identity provider domain, causing stored credentials to be submitted to an attacker-controlled site when the victim user opens the malicious entry. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

CWE-297 (Improper Validation of Certificate with Host Mismatch) describes failures in host identity verification during domain or certificate checks at the application layer. In Devolutions Remote Desktop Manager - a privileged access management and remote desktop platform - the social login autofill feature is designed to detect the active web entry's target URL and automatically populate stored OAuth or social login credentials. The flaw lies in insufficient hostname validation: the feature does not enforce strict matching against a whitelist of legitimate provider domains, allowing homograph, typosquat, or lookalike domains (e.g., a domain resembling 'accounts.google.com') to pass validation and receive autofilled credentials. The affected product is identified by CPE cpe:2.3:a:devolutions:remote_desktop_manager in all builds from 2026.2.0 through 2026.2.8, as confirmed by ENISA EUVD-2026-37024.

RemediationAI

Upgrade Devolutions Remote Desktop Manager to a version beyond 2026.2.8 as directed by the vendor security advisory DEVO-2026-0018 at https://devolutions.net/security/advisories/DEVO-2026-0018/. The exact patched release version is not independently confirmed from the available input data and must be verified directly against that advisory before deployment. As an interim compensating control, administrators should restrict or audit which users are permitted to create or import web entries in shared RDM environments, since the attack requires an adversary to plant a crafted entry. Users should avoid opening web entries sourced from untrusted parties and should audit existing web entries configured with external social or OAuth provider URLs for suspicious domain names. Disabling the social login autofill feature entirely eliminates the attack surface at the cost of losing that productivity feature; this trade-off may be acceptable in high-security deployments pending a patch.