CVE-2026-126328

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.

• CWE-312

• https://devolutions.net/security/advisories/DEVO-2026-0041/

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12630Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression …4.3
• CVE-2026-12631The Zephyr kernel validates the k_thread_join() and k_thread…6.5
• CVE-2026-12632Zephyr's Precision Time Protocol receive handler ptp_msg_pos…6.5
• CVE-2026-126325A critical remote code execution (RCE) vulnerability has bee…9
• CVE-2026-126326Improper access control in the administrative role assignmen…
• CVE-2026-126327Improper access control in the connection history in Devolut…
• CVE-2026-126329Docker Sandboxes reuses existing state and configuration dir…7.3
• CVE-2026-12633The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c…8.1
• CVE-2026-126330Docker Sandboxes can silently republish a sandbox service af…2.4
• CVE-2026-126331Insertion of sensitive information into sent data in the use…
• CVE-2026-126332Improper access control in the autofill vault search in Devo…
• CVE-2026-12634The NVS backend of the Zephyr settings subsystem (subsys/set…5.3