Sensitive Information Leakage in Devolutions PowerShell Universal Automation Jobs API
CVE-2026-16798

Currently unrated

Key Information:

Vendor: Devolutions
Status: Powershell Universal
Vendor: CVE Published:; 24 July 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-16798?

An issue in the automation jobs API of Devolutions PowerShell Universal allows authenticated users with specific permissions to inadvertently access another user's OAuth refresh token through job response data. This occurs due to inadequate sanitization of the response, which fails to remove sensitive tokens before transmission.

Affected Version(s)

PowerShell Universal 0 < 2026.2.3

References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 24, 2026
Vulnerability Reserved
Jul 23, 2026

CVE-2026-16798 Data

JSON