Dashboard / CVE-2026-4927

CVE-2026-4927

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-04-01 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions devolutions_server 2026.1.6.0 – 2026.1.12.0

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002330
Percentile 14.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00233
2026-10-28
0.00224

Intelligence Sources

nvd ref →

External Links