CVE-2026-4927

—

CVSS 3.1

6.5 medium

EPSS

<1%p13

Published

Apr 1, 2026 (Apr 1, 2026)

Modified

Jun 17, 2026

Description

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-201
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.