Cleartext Storage Vulnerability in Devolutions Server from Devolutions

CVE-2026-120733

What is CVE-2026-120733?

The Devolutions Server, up to version 2026.3.12.0, is susceptible to a critical issue involving the cleartext storage of sensitive user account data. This vulnerability enables an attacker with access to the database or backups to extract users' TOTP shared secrets. The security risk arises from the unencrypted storage of these keys when an administrator saves user data, potentially leading to unauthorized access and compromise of user accounts.

References