CVE-2026-4828

Published: Apr 1, 2026Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.

Affected (2)

Products: Devolutions: Devolutions Server

Devolutions

1 product

Devolutions Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Before 2025.3.18.0
Devolutions Devolutions Server	From 2026.1.1.0 to 2026.1.12.0

Related CWEs

CWE-1390

Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0010

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.