← Back

CVE-2026-13437

nvd nist
Published: Jun 29, 2026Modified: Jul 2, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

Affected (1)

Devolutions
1 product
Powershell Universal
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Powershell Universal
Version 2026.2.0.0

Related CWEs

CWE-201
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (1)

Source: security@devolutions.net
Vendor Advisory

Timeline

No history available yet.