PT-2026-40107 · Devolutions · Server+1
Jtof_Fap
·
Published
2026-05-12
·
Updated
2026-05-12
·
CVE-2026-8407
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.11.0
Devolutions Server 2025.3.16.0 and earlier
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Server
Devolutions Server