Total 168 security vulnerabilities recorded for devolutions software and firmware.
Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect vic...
Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profi...
Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create ...
Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of...
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user wit...
Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authenticat...
Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the r...
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrar...
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain ...
Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content fro...
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their...
Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side ...
Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OT...
Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and ...
Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with val...
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenti...
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials t...
Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disable...
Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle...
Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated use...
Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated...
Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error ...
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to...
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3...