CVE-2026-4828

Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.

Score

CVSS 3.1 8.2 High

Status

Analyzed - security@devolutions.net

Published

2026-04-01

Last modified

2026-10-26

Weaknesses

CWE-1390

Affected products

• Devolutions Server (Devolutions)
• Server (Devolutions)

References

• https://devolutions.net/security/advisories/DEVO-2026-0010