CVE-2026-120733

Full vulnerability record from the local CVENow database.

Description

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-03 21:17:04.547000

Last modified

2026-11-03 21:17:04.640000

View original CVE JSON

{
  "id": "CVE-2026-120733",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T21:17:04.547",
  "lastModified": "2026-11-03T21:17:04.640",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Devolutions",
          "product": "Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2026.3.13.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://devolutions.net/security/advisories/DEVO-2026-0039/",
      "source": "[email protected]"
    }
  ]
}