CVE-2024-1900

Published: Mar 5, 2024Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.1 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The user will stay authenticated until the Devolutions Server token expiration.

Affected (1)

Products: Devolutions: Devolutions Server

1 product

Devolutions Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Up to 2023.3.16.0

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://devolutions.net/security/advisories/DEVO-2024-0002

Source: security@devolutions.net

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2024-0002

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.