Cleartext storage of sensitive information in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the server’s database to obtain external identity provider tokens and active session identifiers. This violates confidentiality and is classified as an authentication data exposure (CWE-312).

Devolutions Server, versions 2026.3.5.0 and earlier.

The vulnerability requires an attacker to already possess read permissions to the server’s database. Once those permissions are held, the attacker can directly inspect stored records and extract tokens or session IDs, potentially hijacking sessions or impersonating users. No network exposure is necessary; the risk is therefore heavily dependent on database security posture, but the impact of successful exploitation is significant. The CVSS score is 7.2, indicating moderate severity, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog.