CVE-2026-16798 Overview
CVE-2026-16798 is an information disclosure vulnerability in the automation jobs API of Devolutions PowerShell Universal version 2026.2.2 and earlier. The flaw allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token. Job read responses fail to strip the refresh token before returning data to the caller. The vulnerability is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data].
Critical Impact
A low-privileged authenticated user can harvest OAuth refresh tokens belonging to other users, enabling impersonation and lateral access to downstream OAuth-protected resources.
Affected Products
- Devolutions PowerShell Universal 2026.2.2 and earlier
- Automation jobs API component
- Scoped job and script read permission model
Discovery Timeline
- 2026-07-24 - CVE-2026-16798 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-16798
Vulnerability Analysis
The vulnerability resides in the automation jobs API endpoints of Devolutions PowerShell Universal. When a client requests job read data, the API returns response objects that include the OAuth refresh token associated with the job's originating user. The response serializer does not strip or redact this sensitive field before returning the payload. Any user holding scoped job or script read permission can therefore observe refresh tokens belonging to other users through routine API queries.
Refresh tokens are long-lived credentials used to obtain new access tokens without re-authentication. Their exposure permits an attacker to mint valid access tokens as the victim identity, bypassing multi-factor authentication and directly consuming the OAuth-protected resources granted to that user.
Root Cause
The root cause is inadequate output filtering in the job read response path. The data model backing job records contains authentication material intended for internal use. The API layer serializes the full record without applying a projection or field-level redaction policy for callers who do not own the record. This design pattern maps to [CWE-201] and reflects a missing separation between internal persistence schema and external API schema.
Attack Vector
Exploitation requires network access to the PowerShell Universal API and an authenticated account with the scoped job or script read permission. The attacker enumerates jobs owned by other identities and reads their responses. Each response containing an OAuth-linked job discloses the associated refresh token. No user interaction is required, and no elevated privileges are needed beyond the read scope.
No public proof-of-concept code is available. Refer to the Devolutions Security Advisory DEVO-2026-0025 for vendor technical details.
Detection Methods for CVE-2026-16798
Indicators of Compromise
- Unusual volume of GET requests against automation job read endpoints by non-owner accounts
- API access patterns where a single account enumerates jobs across multiple user contexts
- Downstream OAuth provider events showing refresh token exchanges from unexpected client IPs
- Sudden access token issuance for user accounts that did not initiate a session
Detection Strategies
- Review PowerShell Universal audit logs for job read operations performed by users who do not own the referenced job
- Correlate API job read events with OAuth token refresh events at the identity provider to detect stolen-token usage
- Alert on scoped read accounts that iterate through job identifiers sequentially or at high frequency
Monitoring Recommendations
- Enable verbose API access logging on PowerShell Universal and forward events to a centralized log platform
- Track OAuth refresh token usage metrics per user and flag anomalies in issuing IP, user agent, or geography
- Monitor role and permission assignments so that job or script read scope is granted only to accounts that require it
How to Mitigate CVE-2026-16798
Immediate Actions Required
- Upgrade Devolutions PowerShell Universal to a version later than 2026.2.2 as instructed in advisory DEVO-2026-0025
- Rotate all OAuth refresh tokens stored by PowerShell Universal automation jobs after patching
- Audit historical job read API access to identify potentially exposed tokens
- Revoke and reissue OAuth client credentials that may have been used with the exposed refresh tokens
Patch Information
Devolutions has released a fix documented in Devolutions Security Advisory DEVO-2026-0025. Apply the vendor-supplied update to remediate the response serialization behavior in the automation jobs API.
Workarounds
- Restrict the scoped job or script read permission to a minimal set of trusted service accounts until the patch is applied
- Remove or reissue OAuth integrations that store refresh tokens within automation jobs, favoring short-lived credentials where feasible
- Segment network access to the PowerShell Universal API so that only authorized management hosts can reach job endpoints
# Configuration example
# Refer to Devolutions Security Advisory DEVO-2026-0025 for vendor-provided remediation guidance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
