CVE-2026-4924 - Vulnerability Analysis

Overview

Devolutions Server <= 2026.1.11 contains a broken authentication caused by reuse of a partially authenticated session token in the two-factor authentication feature, letting remote attackers with valid credentials bypass multifactor authentication.

Severity & Score

Impact

Remote attackers with valid credentials can bypass multifactor authentication and gain unauthorized access to victim accounts.

Mitigation

Update to a version later than 2026.1.11 or the latest available version.

References

• https://devolutions.net/security/advisories/DEVO-2026-0010

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner