Live › vulnerability › CVE-2026-120716
Devolutions Server 2026.3.13.0 and earlier include sensitive data in the identity provider user synchronization API response. An authenticated user with the delegated permission to update users from the identity provider can read other users' MFA secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Devolutions Server 2026.3.13.0 or earlier with identity provider user synchronization enabled. Exposure requires an account holding the delegated permission to update users from the identity provider. Installations on later versions or without identity provider sync are not described as affected.
No product ranges from the sources yet.
2026.3.13.0 and earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
This page as .md · .json · in your agent: get_signal("CVE-2026-120716")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.