CVE-2026-4829
Improper Authentication in Devolutions Server OAuth Enables Privilege Escalation
Publication date: 2026-04-01
Last updated on: 2026-04-03
Assigner: Devolutions Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devolutions | devolutions_server | to 2026.1.12.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper authentication issue in the external OAuth authentication flow of Devolutions Server version 2026.1.11 and earlier. It allows an authenticated user to reuse a session code from an external authentication flow to authenticate as other users, including administrators.
How can this vulnerability impact me? :
The vulnerability can allow an authenticated user to impersonate other users, including administrators, by reusing session codes. This could lead to unauthorized access to sensitive information, administrative functions, and potentially full control over the affected system.