Live › vulnerability › CVE-2026-114485
Go to dashboardDevolutions Server 2026.3.10.0 and earlier include MFA secrets for all users in the user list API response. An authenticated attacker with delegated user-view permission can read those secrets and use them to generate valid MFA codes for other accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Devolutions Server at version 2026.3.10.0 or earlier that have delegated user view permissions assigned to some accounts. Servers on newer versions, or with no delegated user-view roles, are not exposed by this flaw as described.
No product ranges from the sources yet.
2026.3.10.0 in the server admin console or the install folder.2026.3.10.0; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
This page as .md · .json · in your agent: get_signal("CVE-2026-114485")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.