---
id: "CVE-2026-126328"
page: "https://infrastack.ai/live/CVE-2026-126328"
kind: "vulnerability"
aliases: ["CVE-2026-126328"]
title: "Devolutions Server: user API leaks users' MFA shared secrets to delegated viewers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Devolutions Server", "fixed": ["2026.3.14.0", "2026.2.24.0"], "affected": "<= 2026.3.13.0; <= 2026.2.23.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "devolutions-server", "mfa", "other", "self-hosted"]
not_affected_if: ["auth-required", "no-delegated-user-viewing"]
published_at: "2026-11-11T22:17:26+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:47:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126328", "first_seen_at": "2026-11-11T22:29:34+00:00"}, {"source": "analyst", "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/", "first_seen_at": "2026-11-11T22:35:49+00:00", "cites": ["https://devolutions.net/security/advisories/DEVO-2026-0041/"]}]
exploit_sources: []
---

# Devolutions Server: user API leaks users' MFA shared secrets to delegated viewers

Link for people: https://infrastack.ai/live/CVE-2026-126328 (this .md is for agents)

Devolutions Server 2026.3.13.0 and earlier include users' MFA shared secrets in user API responses. An authenticated user with delegated user-viewing permissions can read those secrets and could use them to generate the victims' one-time codes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Devolutions Server affected <= 2026.3.13.0; <= 2026.2.23.0 fixed 2026.3.14.0, 2026.2.24.0

## How to check

Check the Devolutions Server version in the admin console. Exposed if it is 2026.3.13.0 or earlier (2026.3 branch) or 2026.2.23.0 or earlier (2026.2 branch). Also list which accounts hold delegated user-viewing permissions; those accounts could read other users' MFA shared secrets.

## Fix

Upgrade Devolutions Server to 2026.3.14.0 or later (2026.3 branch), or 2026.2.24.0 or later (2026.2 branch). Vendor lists no workaround. Afterwards consider rotating MFA secrets of users visible to delegated viewers.

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126328
- 2026-11-11T22:35:49+00:00 analyst https://devolutions.net/security/advisories/DEVO-2026-0041/ — Read Devolutions DEVO-2026-0041 (primary): fixed in 2026.3.14.0 / 2026.2.24.0; no workaround listed. Not exploited, no PoC seen; no social search done.

## Documents

- [advisory] Devolutions DEVO-2026-0041 https://devolutions.net/security/advisories/DEVO-2026-0041/

## From the sources

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_