Authorization Flaw in Devolutions Server's PAM Module

CVE-2026-8407

What is CVE-2026-8407?

A missing authorization vulnerability in the PAM module of Devolutions Server permits an authenticated user equipped with a PAM license, but lacking additional permissions, to exploit specially crafted requests to the PAM API. This exploitation enables unauthorized retrieval of OTP secret keys and recovery codes, potentially compromising sensitive authentication processes. The flaw primarily affects specific versions of Devolutions Server, highlighting the need for immediate attention and remediation.

References