CVE-2026-120716 in Server
Summary
by MITRE • 11/03/2026
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CWE-209, which involves the generation of error messages containing sensitive information, manifests within the Devolutions Server 2026.3.13.0 and earlier versions during the process of identity provider user synchronization. This specific flaw allows an authenticated attacker who possesses delegated permissions to update users from the connected identity provider to extract Multi-Factor Authentication (MFA) secrets belonging to other users through the API response generated by the synchronization mechanism. The core technical issue lies in how the system handles and returns data during the bulk update or synchronization operations, where sensitive cryptographic material intended for internal use is inadvertently exposed in plaintext within the HTTP response payload sent back to the client application initiating the request.
From a technical perspective, this vulnerability represents an information disclosure flaw that bypasses standard access controls by leveraging legitimate administrative functions. When an authorized user triggers a synchronization event with the identity provider, the server processes the incoming data and attempts to map or update local user accounts based on external directory entries. During this process, if certain conditions are met regarding how the MFA secrets are stored or retrieved for comparison purposes, the system includes these sensitive values in the response body rather than masking them or omitting them entirely. This behavior violates fundamental security principles such as CWE-201 and CWE-538, which dictate that information should not be exposed unnecessarily to unauthorized parties, even those with limited privileges, if it can lead to further compromise of system integrity.
The operational impact of this vulnerability is severe because MFA secrets are critical components of the authentication infrastructure. An attacker who successfully exploits this flaw can obtain the TOTP seeds or other cryptographic keys used by multiple users for two-factor authentication. With these secrets in hand, the adversary can bypass the second factor of authentication entirely, effectively neutralizing one of the most effective defenses against unauthorized access. This capability facilitates account takeover attacks and lateral movement within the environment, as the attacker gains full administrative control over targeted accounts without needing to compromise passwords or intercept real-time codes. The attack aligns with MITRE ATT&CK technique T1528, which involves stealing application access tokens, although in this case, it specifically targets MFA credentials rather than session tokens, falling under broader categories of credential theft and privilege escalation.
Mitigation strategies must focus on immediate remediation through software updates as well as architectural improvements to prevent recurrence. The primary defense is to upgrade Devolutions Server to version 2026.3.13.1 or later, where the developers have addressed this information leakage by ensuring that MFA secrets are never included in API responses regardless of synchronization status. In addition to patching, organizations should implement strict input validation and output encoding practices within their own applications interacting with Devolutions APIs to ensure no sensitive data is logged or displayed inadvertently. Security teams should also audit existing logs for any evidence of prior exploitation by monitoring for unusual patterns in user synchronization requests that result in large response payloads containing base64-encoded strings typical of MFA secrets. Furthermore, enforcing the principle of least privilege ensures that only essential administrators have access to identity provider synchronization features, thereby reducing the attack surface available to potential insiders or compromised accounts seeking to harvest these critical credentials.