CVE-2026-12162

—

CVSS 3.1

5.5 medium

EPSS

<1%p4

Published

Jun 16, 2026 (Jun 16, 2026)

Modified

Jun 17, 2026

Description

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

Vendors: devolutions
Products: remote desktop manager
Weakness: CWE-297
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.