What is the CVSS score of CVE-2026-8407?

CVE-2026-8407 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-8407

EUVD-2026-29544 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 DEVOLUTIONS

GHSA-4mvv-f9gf-4m5q

Authentication Bypass Server

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 16:23 vuln.today

CVSS changed

May 13, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

May 12, 2026 - 16:16 nvd

MEDIUM 4.3

CVE Published

May 12, 2026 - 16:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints.

This issue affects the following versions :

Devolutions Server 2026.1.6.0 through 2026.1.11.0

Devolutions Server 2025.3.16.0 and earlier

AnalysisAI

Missing authorization in the PAM module of Devolutions Server allows authenticated users with a PAM license to retrieve OTP secret keys and recovery codes without additional permissions, leading to account compromise through crafted API requests. Affected versions include Devolutions Server 2025.3.16.0 and earlier, plus 2026.1.6.0 through 2026.1.11.0. No public exploit code or active exploitation has been identified; however, the low CVSS score and minimal EPSS percentile suggest limited real-world attack incentive despite the confidentiality impact.

Technical ContextAI

The vulnerability stems from insufficient authorization checks (CWE-862) in the PAM module's API endpoints that handle OTP secrets and recovery codes. The PAM (Privileged Access Management) module in Devolutions Server is designed to secure sensitive credentials and multi-factor authentication data; however, the implementation fails to verify that the requesting authenticated user has explicit permissions beyond holding a PAM license to access these endpoints. The affected products are specifically identified by CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, indicating all configurations of the affected version ranges are vulnerable when the PAM module is deployed.

RemediationAI

Upgrade Devolutions Server immediately to version 2025.3.17.0 or later for the 2025.3.x branch, or to 2026.1.12.0 or later for the 2026.1.x branch. The patch restores proper authorization checks to PAM API endpoints and must be applied to all Devolutions Server instances with the PAM module active. Consult the Devolutions security advisory DEVO-2026-0010 at https://devolutions.net/security/advisories/DEVO-2026-0010/ for precise patch availability and deployment guidance. As an interim compensating control (with significant operational trade-off), restrict network access to PAM API endpoints via firewall rules to only trusted administrative clients, but this is NOT a substitute for patching and will degrade PAM functionality for legitimate remote users. Organizations unable to patch immediately should audit PAM module API logs for unauthorized access attempts and review OTP secret/recovery code access by non-administrative users.