PT-2026-22830 · Microsoft+1 · Azure Ad+2

Truff5.1 · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-3224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.15.0 and earlier

Description An authentication bypass exists in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated user can authenticate as an arbitrary Entra ID user by using a forged JSON Web Token (JWT). The issue affects the /api/v1/login endpoint, where a malicious actor can manipulate the JWT parameter to gain unauthorized access.

Recommendations Versions prior to 2025.3.15.0 should be updated.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-3224

Affected Products

Azure Ad

Devolutions Server

Entra Id

References · 8

• https://devolutions.net/security/advisories/DEVO-2026-0005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3224 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3224 · Vendor Advisory
• https://twitter.com/CVEnew/status/2028959730576552415 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028961558659793212 · Twitter Post
• https://t.me/CVEtracker/46249 · Telegram Post
• https://t.me/cveNotify/154126 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029241033159262640 · Twitter Post