CVE-2026-9226 in Server
Summary
by MITRE • 10/06/2026
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an authentication bypass within the Azure AD external login flow of Devolutions Server versions 2026.3.7.0 and earlier represents a critical security flaw that undermines the integrity of single sign-on mechanisms. This issue specifically affects the integration between the application and Microsoft Entra ID, formerly known as Azure Active Directory, where the authentication process relies on standard OAuth or OpenID Connect protocols. The core technical deficiency lies in how the server handles redirect URLs during the token exchange phase. When a user initiates login via an external identity provider, the system generates a temporary session state that is often transmitted through browser redirects to maintain continuity between the client and the service provider. In this specific implementation, sensitive authentication tokens or session identifiers are inadvertently exposed within these redirect URLs rather than being securely stored in server-side sessions or HttpOnly cookies. This exposure creates a direct vector for attackers who can intercept these URL parameters during transit if proper transport layer security measures are not strictly enforced or if the user navigates through untrusted intermediaries that log URI history.
From an operational perspective, this flaw allows a remote attacker to perform token replay attacks with significant ease. By capturing the login-session token embedded in the redirect URL, typically via browser history logs, network sniffing on insecure networks, or cross-site scripting vulnerabilities that leak referrer data, an adversary can reuse this credential fragment to impersonate the legitimate user. The server fails to adequately validate the uniqueness and expiration of these tokens when presented through subsequent requests derived from the compromised URI. Consequently, the attacker gains unauthorized access to the victim's account without needing valid credentials such as passwords or multi-factor authentication responses. This bypass effectively nullifies the security controls provided by Azure AD external login flows, allowing full account takeover which can lead to data exfiltration, privilege escalation within the Devolutions Server environment, and potential lateral movement into connected systems if administrative privileges are held by the compromised user.
This vulnerability aligns with CWE-287, Improper Authentication, as it involves a failure in verifying identity credentials during the authentication process. Furthermore, it relates to CWE-359, Exposure of Private Information Within a URL, due to the sensitive data being transmitted via query parameters rather than secure headers or body payloads. In terms of adversary tactics, this scenario maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically under the sub-tactic of Using Cloud Accounts, where attackers leverage stolen credentials from identity providers to gain access. The exploitation method also reflects aspects of T1539, Steal Web Session Cookie, although in this case, it involves session tokens exposed via URI rather than traditional cookies.
To mitigate this risk, organizations running affected versions must immediately upgrade Devolutions Server to version 2026.3.7.1 or later where the redirect handling logic has been corrected to prevent token exposure in URLs. Until an update is applied, administrators should enforce strict HTTPS policies across all endpoints and ensure that browser history logging is disabled on shared or public machines accessing the application. Additionally, implementing Content Security Policy headers with a restrictive referrer-policy directive can help mitigate information leakage by preventing the transmission of URL fragments to third-party sites during redirects. Regular auditing of access logs for unusual patterns involving repeated token usage from different IP addresses may also aid in early detection of exploitation attempts.