CVE-2026-105485: Devolutions Server OAuth Auth Bypass

CVE-2026-105485 Overview

CVE-2026-105485 is an authentication bypass vulnerability in the OAuth device authorization flow of Devolutions Server. Versions 2026.3.7.0 and earlier allow a remote attacker to take over a user's account by replaying a captured device verification link after an authenticated victim interacts with it. The flaw maps to CWE-294: Authentication Bypass by Capture-replay. Successful exploitation grants the attacker access under the victim's identity, exposing stored secrets and privileged workflows managed by the server.

Critical Impact
An attacker who captures and replays a device verification link can hijack the authenticated session of a Devolutions Server user, resulting in full account takeover.

Affected Products

Devolutions Server 2026.3.7.0
Devolutions Server versions prior to 2026.3.7.0
OAuth device authorization flow component within Devolutions Server

Discovery Timeline

2026-10-06 - CVE-2026-105485 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105485

Vulnerability Analysis

The vulnerability resides in how Devolutions Server handles the OAuth 2.0 device authorization grant. In a healthy implementation, the verification link or user code consumed during device authorization is bound to a single device session and invalidated after use. Devolutions Server fails to enforce single-use semantics on the device verification link, so a captured link can be replayed by another party to obtain the tokens issued to the victim.

Exploitation requires user interaction. The authenticated victim must follow the device verification link that the attacker initiated or captured. Attack complexity is high because the attacker must obtain the link and replay it within its validity window, but no credentials are required on the attacker side.

Root Cause

The root cause is a missing or insufficient binding between the device authorization request and the identity completing the verification. Because the server trusts the verification event rather than enforcing session binding, nonce freshness, or client fingerprinting, the attacker's polling device receives the access token that should belong only to the originating device.

Attack Vector

The attack vector is network-based. An attacker initiates an OAuth device authorization request against Devolutions Server and obtains a user_code and verification URI. The attacker then delivers that verification link to a target user, typically via phishing or a trusted channel. When the authenticated victim visits the link and approves the device, the attacker's waiting client polls the token endpoint and receives valid tokens for the victim's account. Technical details are documented in the Devolutions Security Advisory DEVO-2026-0035.

Detection Methods for CVE-2026-105485

Indicators of Compromise

Successful OAuth device authorization completions originating from IP addresses or user agents that do not match the user's typical session telemetry.
Access token issuance events where the polling client and the approving browser session originate from different geographic locations or ASNs.
Repeated device authorization requests for the same account within short time windows, consistent with attacker-initiated flows.

Detection Strategies

Correlate Devolutions Server authentication logs with endpoint telemetry to identify device authorization approvals that lack a corresponding legitimate client enrollment.
Alert on OAuth device flow approvals followed by immediate access to privileged vaults, credential entries, or administrative APIs.
Baseline normal device authorization usage per user and flag deviations such as approvals outside business hours or from unmanaged devices.

Monitoring Recommendations

Forward Devolutions Server audit logs to a centralized SIEM and retain OAuth token issuance events for correlation.
Monitor for user-reported phishing emails that contain Devolutions Server verification URIs or user_code strings.
Track session anomalies such as token use from a client that never completed an interactive sign-in prompt.

How to Mitigate CVE-2026-105485

Immediate Actions Required

Upgrade Devolutions Server to a release later than 2026.3.7.0 that contains the fix referenced in advisory DEVO-2026-0035.
Revoke active OAuth tokens and force reauthentication for all users after upgrading.
Review recent device authorization approvals and audit privileged account activity for signs of replay abuse.

Patch Information

Devolutions published remediation guidance in the Devolutions Security Advisory DEVO-2026-0035. Administrators should apply the fixed release identified in the advisory and validate that the device authorization flow enforces single-use verification codes after upgrade.

Workarounds

Disable the OAuth device authorization grant on Devolutions Server if it is not required by client applications.
Restrict Devolutions Server administrative interfaces to trusted networks and enforce multi-factor authentication for all accounts.
Train users to recognize unsolicited device verification prompts and to report them before approving.

bash

# Configuration example
# After upgrading Devolutions Server, verify installed version meets the fixed release
# Replace <server-host> with your Devolutions Server hostname
curl -sk https://<server-host>/api/version

# Revoke existing OAuth sessions via the admin console or API after patching
# Consult DEVO-2026-0035 for the exact endpoint and parameters in your version