Beschreibung
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVSS 5EPSS 0.254%Risiko 0.51
Quelle öffnen- Veröffentlicht
- 2026-04-01 16:23:52
- Betroffene Versionen
- >=2026.1.6,<2026.1.12
- Typ
- Core software
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N