Sensitive Data Exposure in Devolutions Server by Devolutions

CVE-2026-126328

What is CVE-2026-126328?

In Devolutions Server versions up to 2026.3.13.0, an issue exists where authenticated users with delegated permissions can access sensitive information. Specifically, the user API responses inadvertently disclose users' multi-factor authentication (MFA) shared secrets. This exposure presents a significant security risk, as it may allow unauthorized actions and compromise user accounts.

References