Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Devolutions Server stores identity tokens in clear text

CVE-2026-100288 · published 1 month ago
Summary

Devolutions Server version 2026.3.5.0 and earlier keeps external identity provider tokens and session IDs in the database without encryption. If someone can read the database, they can see these tokens and potentially hijack user sessions. Protect the database with strong access controls and upgrade to a version that encrypts this data.

What to do
  • Update devolutions server to version 2026.3.7.0 or later.
Affected software
VendorProductAffected versions
devolutions server < 2026.3.7.0
Original advisory text
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider toke...
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published29 Sep 2026
Updated2 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-100288 · NVD
CVE-2026-100288 · MITRE
Track software like this
Free during beta