Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access

Devolutions Server2026-11-03 21:17 UTC1 min readRead in

Summary

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.

Remediation

Inventory every Devolutions Server deployment, including staging.
Upgrade Devolutions Server to 2026.3.13.0.
Confirm the running version after the upgrade.

References

Referencehttps://devolutions.net/security/advisories/DEVO-2026-0039/

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Version	Fixed in
0 – <2026.3.13.0	2026.3.13.0

Weakness

CWE-312

Exploit probability (EPSS)

0.1%

Timeline

2026-11-03Publicly disclosed

Sources

NVD · CVE