CVE-2026-120733 in Server
Summary
by MITRE • 11/03/2026
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Devolutions Server versions 2026.3.12.0 and earlier represents a critical failure in data protection mechanisms, specifically categorized under CWE-312 as Cleartext Storage of Sensitive Information. This flaw resides within the user account management subsystem where security credentials are persisted to the underlying database without adequate encryption or hashing protections. When an administrator configures Two-Factor Authentication for a user by saving their Time-based One-Time Password shared secret, the system writes this sensitive cryptographic material directly into the database in its original plaintext format rather than applying industry-standard secure storage practices such as salted hashing or encrypted field storage with key management protocols.
The technical nature of this flaw allows any actor who gains read access to the Devolutions Server database or possesses a backup file containing that data to extract these shared secrets immediately upon retrieval. Unlike passwords which are typically stored using one-way hash functions requiring computational effort to reverse, TOTP shared secrets are symmetric keys required for real-time authentication generation. Their exposure effectively neutralizes the second factor of authentication because an attacker possessing both the user's password and their plaintext TOTP secret can generate valid time-based codes indistinguishable from those generated by the legitimate user's authenticator application. This bypasses the intended security boundary established by multi-factor authentication protocols.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1539 which involves Steal Web Session Cookie but extends to credential harvesting via database exfiltration techniques similar to T1005 Data from Local System. The operational impact is severe as it compromises the integrity of identity verification processes across all accounts configured for two-factor authentication within the affected version range. An attacker with low-privilege access to the database, or a malicious insider with backup restoration capabilities, can systematically harvest these secrets to facilitate unauthorized access to sensitive resources protected by Devolutions Server. This undermines trust in the platform's ability to safeguard high-value credentials and exposes organizations to potential account takeover attacks even when strong authentication policies are enforced at the application level.
Mitigation strategies must prioritize immediate remediation of the storage mechanism alongside compensating controls for existing data exposure. The primary corrective action involves upgrading Devolutions Server to a version where this vulnerability has been patched, ensuring that future TOTP secrets and other sensitive credentials are stored using encrypted fields or secure key management services compliant with standards such as NIST SP 800-63B regarding digital identity guidelines. For environments unable to upgrade immediately, administrators should rotate all affected user passwords and regenerate their TOTP shared secrets after applying any available security patches that enforce encryption at rest for sensitive account data. Additionally, implementing strict database access controls using the principle of least privilege can limit the blast radius by ensuring only essential service accounts have read permissions on tables containing authentication material, thereby reducing the likelihood of successful exploitation by unauthorized actors who may gain initial foothold through other vectors such as SQL injection or credential stuffing attacks against administrative interfaces.