CVE-2026-114485 in Server
Summary
by MITRE • 10/22/2026
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Devolutions Server versions 2026.3.10.0 and prior represents a critical failure in data exposure controls within the application's user management interface. Specifically, this flaw resides in the endpoint responsible for retrieving lists of users, which is designed to provide administrative or delegated oversight capabilities rather than full credential disclosure. The core technical deficiency lies in the serialization process used by the API response mechanism. When an authenticated request is made to fetch user details, the backend service inadvertently includes sensitive multi-factor authentication (MFA) secret keys within the returned JSON payload. These secrets are typically intended for internal cryptographic operations or secure storage and should never be transmitted over network interfaces in plaintext or even encrypted form without explicit authorization contexts that justify such exposure. This design oversight effectively bypasses standard security boundaries, allowing any user with delegated view permissions to access data reserved strictly for system administrators or specific high-privilege roles.
From a technical perspective, this issue aligns closely with CWE-209: Generation of Error Message Containing Sensitive Information and more critically CWE-538: Insertion of Sensitive Information into Externally-Accessible Data Structure. The vulnerability exploits the principle of least privilege by granting broader data access than necessary for the stated function of listing users. In a typical secure architecture, user list endpoints should return only non-sensitive identifiers such as usernames, display names, and status flags. By including MFA secrets, which are often base64-encoded strings used to generate time-based one-time passwords (TOTP), the application exposes the cryptographic material required to impersonate these users. This is not merely a configuration error but a fundamental flaw in how sensitive attributes are handled during API response construction, indicating that the data model or serialization layer lacks proper filtering of high-sensitivity fields based on the requesting user's role context.
The operational impact of this vulnerability is severe and directly compromises the integrity of multi-factor authentication across the entire organization. MFA secrets serve as the second factor in a two-factor authentication scheme; if an attacker obtains these secrets, they can bypass the additional layer of security intended to protect against compromised passwords alone. An authenticated attacker with delegated user view permissions could systematically scrape this endpoint for all users and subsequently use the extracted MFA secrets alongside stolen or guessed usernames and passwords to gain unauthorized access to accounts. This effectively neutralizes the protective value of MFA, reducing it to a single-factor authentication model where only password strength matters. Furthermore, because the attacker is already authenticated with delegated permissions, they may also leverage this access to perform reconnaissance on other sensitive data exposed through similar endpoints, escalating their position within the network environment.
This vulnerability maps directly to MITRE ATT&CK technique T1078: Valid Accounts and specifically sub-technique T1528: Steal Application Access Token or Credential Harvesting via API abuse. The attacker utilizes valid credentials with limited privileges to harvest high-value secrets, demonstrating a classic privilege escalation path through data exposure rather than code execution. To mitigate this risk, immediate action is required by upgrading Devolutions Server to version 2026.3.10.1 or later where the issue has been patched. In the interim, organizations should enforce strict network segmentation and firewall rules to restrict access to the user list API endpoint only from trusted administrative subnets if possible. Additionally, implementing Web Application Firewall (WAF) rules that detect and block responses containing patterns consistent with base64-encoded MFA secrets can provide a temporary layer of defense. It is also imperative to rotate all affected MFA secrets immediately upon patching or mitigation implementation, as any previously harvested data remains valid until the underlying cryptographic material is changed. Regular security audits focusing on API response payloads are recommended to ensure no other sensitive fields such as private keys or session tokens are inadvertently exposed in similar endpoints.