EUVD-2026-31450
GHSA-6h3w-2xh7-wr95
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Network-reachable but requires the victim's known password (PR:L) and the victim's MFA reconfiguration action (UI:R); MFA bypass yields full account takeover, so C:H/I:H with limited availability impact.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
4DescriptionCVE.org
Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors.
This issue affects :
- Devolutions Server 2026.1.6.0 through 2026.1.16.0
AnalysisAI
Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile).
Technical ContextAI
Devolutions Server is a self-hosted privileged access, password, and credential management platform, and the weakness lives specifically in its multi-factor authentication management feature. The root cause is CWE-305 (Authentication Bypass by Primary Weakness): when a user reconfigures their MFA factors, the server improperly handles the underlying factor key state, leaving a stale or predictable key that the MFA check still trusts. Because the MFA layer is the primary access-control mechanism protecting an account whose password is already known, mishandling that state collapses the second factor entirely. The single affected CPE is cpe:2.3:a:devolutions:server, confirming the flaw is in the server product rather than a client or gateway component.
RemediationAI
Upgrade Devolutions Server to a fixed release above the affected 2026.1.16.0 band as directed in vendor advisory DEVO-2026-0013 (https://devolutions.net/security/advisories/DEVO-2026-0013/); the input does not include an exact patched version number, so treat 'Patch available per vendor advisory' as the status and confirm the precise fixed build directly with Devolutions before deployment. As compensating controls until patched, force credential rotation for all users and require any user who recently reconfigured or is about to reconfigure MFA factors to re-enroll after the upgrade so stale factor key state is invalidated (trade-off: user friction and helpdesk load). Because exploitation depends on a known password, prioritize resetting passwords for accounts suspected of credential exposure and tighten monitoring/alerting on MFA reconfiguration events and post-reconfiguration logins from anomalous locations to detect abuse (trade-off: added alert volume, no prevention on its own).
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same weakness CWE-305 – Authentication Bypass by Primary Weakness
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today