CVE-2026-3277: Ironmansoftware PowerShell Universal

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

Affected products

• Ironmansoftware PowerShell Universal: before 2026.1.3 (fixed in 2026.1.3)

Published 2026-02-27. Last modified 2026-06-17.