Description
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVSS 5EPSS 0.254%Risk 0.51
View source- Published
- 2026-04-01 16:23:52
- Affected versions
- >=2026.1.6,<2026.1.12
- Type
- Core software
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N