Authentication Bypass in Devolutions Server by Devolutions
CVE-2026-105485

6.8MEDIUM

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
6 October 2026

What is CVE-2026-105485?

A vulnerability in Devolutions Server allows remote attackers to bypass authentication through the OAuth device authorization flow. By replaying a captured device verification link from an authenticated user, attackers can gain unauthorized access to the user's account. This issue affects Devolutions Server versions 2026.3.7.0 and earlier, making it critical for users to update to the latest version to protect against potential account takeovers. For further details, refer to the advisory at Devolutions' security page.

Affected Version(s)

Server 0 < 2026.3.8

References

https://devolutions.net/security/advisories/DEVO-2026-0035/

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.