Live › vulnerability › CVE-2026-120733
Devolutions Server 2026.3.12.0 and earlier store a cleartext copy of users' TOTP shared secrets when an administrator saves a user. Anyone who can read the database or a database backup can take those secrets and generate the users' one-time codes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Organizations running Devolutions Server at or below 2026.3.12.0 that use TOTP two-factor authentication for user accounts. The exposure requires read access to the database or a backup, so the risk is highest where backups are widely accessible.
No product ranges from the sources yet.
2026.3.12.0 and earlier).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
This page as .md · .json · in your agent: get_signal("CVE-2026-120733")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.