EUVD-2026-17919
GHSA-g894-3pcr-4hv9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.
AnalysisAI
Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis.
Technical ContextAI
The vulnerability resides in Devolutions Server's OAuth login implementation, which fails to properly validate authentication state during the multi-factor authentication flow. CWE-1390 (Improper Validation of Unsafe Equivalence in Input) indicates the root cause involves insufficient validation of equivalence checks-likely in OAuth token verification or MFA session state validation. Attackers who possess valid user credentials can craft malicious OAuth login requests that bypass the MFA enforcement, potentially by manipulating session parameters, token validation logic, or OAuth callback handling. Devolutions Server is a centralized credential and identity management solution; compromise of MFA bypass enables unauthorized access to sensitive credentials and secrets stored within the platform.
RemediationAI
Organizations should immediately upgrade Devolutions Server to version 2026.1.12 or later, which contains the authentication validation fix. Detailed patching instructions and version availability are provided in the official security advisory DEVO-2026-0010 at https://devolutions.net/security/advisories/DEVO-2026-0010. As an interim mitigation pending patch deployment, administrators should audit recent login activity and MFA logs for OAuth-based authentication attempts, consider restricting OAuth login endpoints to trusted networks, and monitor for anomalous credential usage patterns from authenticated user accounts.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same weakness CWE-1390 – Weak Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today