PT-2026-136444

CVE-2026-120716

·

Published

2026-11-03

·

Updated

2026-11-03

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
Vendors
Affected products
Weakness enumeration
CWE-201: Insertion of Sensitive Information Into Sent Data
Related identifiers
CVE-2026-120716
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com