CVE-2026-114485 Overview
CVE-2026-114485 is an information disclosure vulnerability in Devolutions Server 2026.3.10.0 and earlier. The user list API endpoint returns multi-factor authentication (MFA) secrets within its response payload. Any authenticated attacker holding delegated user view permissions can read the MFA secrets of every user in the environment. Exposing these shared secrets allows an attacker to generate valid time-based one-time password (TOTP) codes offline, defeating the MFA layer protecting privileged accounts. The weakness is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data. Devolutions documented the issue in advisory DEVO-2026-0037.
Critical Impact
An authenticated user with delegated view rights can harvest MFA secrets for every account, enabling tenant-wide MFA bypass and account takeover of privileged users.
Affected Products
- Devolutions Server 2026.3.10.0 and earlier
- Deployments exposing the user list API endpoint
- Environments granting delegated user view permissions to non-administrators
Discovery Timeline
- 2026-10-22 - CVE-2026-114485 published to the National Vulnerability Database (NVD)
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114485
Vulnerability Analysis
The flaw resides in the Devolutions Server user list API endpoint. The endpoint serializes user records that include MFA secret material alongside normal profile attributes. Authorization for the endpoint is scoped to the delegated user view permission, but the response body is not filtered to remove sensitive fields based on the caller's privilege level. Any authenticated principal with that delegated permission receives the complete record set, including TOTP seeds used by Devolutions Server to generate MFA codes.
An attacker who extracts these seeds can replay them in any standards-compliant TOTP generator. The attacker then possesses the second factor for every user in the directory, including administrators. Combined with phished or reused passwords, this collapses the MFA control that protects privileged credential vaults managed by Devolutions Server.
Root Cause
The root cause is improper output filtering on the user list API response, consistent with [CWE-201]. The data transfer object returned by the endpoint retains the MFA secret property instead of returning a redacted or placeholder value. The authorization check verifies that the caller may enumerate users but does not restrict which per-user fields are included in the serialized payload.
Attack Vector
Exploitation requires an authenticated session on the Devolutions Server instance and the delegated user view permission. The attacker issues a request to the user list endpoint and parses the JSON response for the MFA secret field of each returned user. No elevated privileges, special tooling, or user interaction are required. The attacker then imports each secret into a TOTP application to produce valid one-time codes on demand. Refer to the Devolutions Security Advisory DEVO-2026-0037 for vendor-confirmed technical details.
Detection Methods for CVE-2026-114485
Indicators of Compromise
- Repeated or high-volume calls to the Devolutions Server user list API from a single authenticated session.
- Successful MFA authentications from new geolocations or devices for accounts that have not rotated their TOTP seed.
- Response payloads from the user list endpoint whose size indicates inclusion of MFA secret fields.
Detection Strategies
- Audit Devolutions Server application logs for user list endpoint access by accounts holding only delegated user view permissions.
- Correlate user list enumeration events with subsequent interactive logins to privileged accounts within short time windows.
- Alert on MFA successes immediately following administrative changes to delegated permissions.
Monitoring Recommendations
- Forward Devolutions Server audit logs to a centralized logging platform and retain them for forensic review.
- Baseline normal API usage per service account and alert on deviations in request volume to the user list endpoint.
- Monitor for unexpected privilege delegation events that grant user view rights to non-administrator principals.
How to Mitigate CVE-2026-114485
Immediate Actions Required
- Upgrade Devolutions Server to a release later than 2026.3.10.0 that contains the fix referenced in advisory DEVO-2026-0037.
- Rotate MFA secrets for every user account after patching to invalidate any secrets exposed before remediation.
- Review all accounts holding delegated user view permissions and revoke the permission where it is not required.
Patch Information
Devolutions has released a fixed build. Administrators should upgrade Devolutions Server to the version identified in Devolutions Security Advisory DEVO-2026-0037 and re-enroll all users in MFA to replace any previously exposed TOTP seeds.
Workarounds
- Remove the delegated user view permission from all non-administrator roles until the server is patched.
- Restrict network access to the Devolutions Server management interface to trusted administrative hosts.
- Force MFA re-enrollment for privileged accounts and consider enabling hardware-backed authenticators that do not rely on shared TOTP seeds.
# Review accounts assigned the delegated user view permission before patching
# Then upgrade Devolutions Server to the fixed release referenced in DEVO-2026-0037
# After upgrade, require MFA re-enrollment for all users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
