Dashboard / CVE-2026-16798

CVE-2026-16798

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-07-24 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions powershell_universal < 2026.2.3.0

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.38%
Raw Score 0.003790
Percentile 31.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00379
2026-10-28
0.00379

Intelligence Sources

nvd ref →

External Links