PT-2026-22830 · Microsoft+1 · Azure Ad+2

Truff5.1 · Publicado 2026-03-03 · Atualizado 2026-03-04 · CVE-2026-3224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.15.0 and earlier

Description An authentication bypass exists in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated user can authenticate as an arbitrary Entra ID user by using a forged JSON Web Token (JWT). The issue affects the /api/v1/login endpoint, where a malicious actor can manipulate the JWT parameter to gain unauthorized access.

Recommendations Versions prior to 2025.3.15.0 should be updated.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-3224

Produtos afetados

Azure Ad

Devolutions Server

Entra Id

Referências · 8

• https://devolutions.net/security/advisories/DEVO-2026-0005 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2028959730576552415 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3224 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2028961558659793212 · Publicação no Twitter
• https://t.me/CVEtracker/46249 · Publicação no Telegram
• https://t.me/cveNotify/154126 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3224 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2029241033159262640 · Publicação no Twitter