CVE-2026-105485

Description

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93782

https://devolutions.net/security/advisories/DEVO-2026-0035/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS