CVE-2026-9245

—

CVSS 3.1

5.0 medium

EPSS

<1%p14

Published

May 22, 2026 (May 22, 2026)

Modified

Jul 23, 2026

Description

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

Vendors: devolutions
Products: devolutions server
Weakness: CWE-601
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.