CVE-2026-105485: Devolutions Server

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

Affected products

• Devolutions Server: before 2026.3.8 (fixed in 2026.3.8)

Published 2026-10-06. Last modified 2026-10-06.