EUVD-2026-31459
GHSA-3v98-q7qw-m4cr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Open redirect yields only credential-phishing risk (C:L); no direct integrity or availability impact justifies I:N and A:N, contra vendor scoring.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link.
This issue affects :
- Devolutions Server 2026.1.6.0 through 2026.1.16.0
- Devolutions Server 2025.3.20.0 and earlier
AnalysisAI
Open redirect in Devolutions Server's external authentication provider flow allows unauthenticated remote attackers to redirect victims to attacker-controlled domains by embedding a crafted redirect parameter in a login link. Affected versions span 2026.1.6.0-2026.1.16.0 and all 2025.3.x releases through 2025.3.20.0, covering a significant window of recent deployments. No public exploit code exists and CISA KEV confirms no active exploitation, though the privileged-access-management context elevates the phishing risk beyond what the raw CVSS 5.0 score suggests.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) describes a failure to validate user-supplied URL parameters before issuing an HTTP redirect. In Devolutions Server, the vulnerability resides specifically in the external authentication provider flow - the code path that handles OAuth 2.0, OIDC, or SAML federation handshakes. During these flows, a redirect_uri or post-login destination parameter is passed in the login link. Improper validation allows an attacker to substitute an arbitrary external domain that the server will honor without whitelist enforcement. The affected product is identified by CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* and is a Privileged Access Management (PAM) platform, meaning the sessions it brokers are high-value targets. Because the redirect occurs after authentication, credentials or session tokens established against the legitimate server could be exposed to or harvested by the destination attacker domain.
RemediationAI
Upgrade to a Devolutions Server version released after 2026.1.16.0 (for the 2026.1.x branch) or after 2025.3.20.0 (for the 2025.3.x branch); the exact patched release version is not specified in available data and must be confirmed via the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/. If immediate upgrade is not feasible, a targeted compensating control is to restrict which external identity providers are permitted in the Devolutions Server configuration and to block or proxy outbound redirects at the perimeter - this reduces the attacker's ability to redirect to arbitrary domains but may affect legitimate federated authentication flows. Additionally, user awareness for administrators: advise them to inspect login URLs before authenticating, particularly any redirect or returnUrl parameter pointing outside the corporate domain. Generic network-level controls such as URL filtering can reduce redirect success but will not eliminate the underlying flaw.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today