CVE-2026-3277: PowerShell Universal Info Disclosure Flaw

CVE-2026-3277 Overview

A sensitive data exposure vulnerability exists in PowerShell Universal before version 2026.1.3. The OpenID Connect (OIDC) authentication configuration stores the OIDC client secret in cleartext within the .universal/authentication.ps1 script file. This insecure storage practice allows any attacker with read access to the configuration file to obtain valid OIDC client credentials, potentially enabling unauthorized authentication or impersonation attacks.

Critical Impact

Cleartext storage of OIDC client secrets enables credential theft by any user with file system read access, potentially compromising the entire authentication infrastructure.

Affected Products

• PowerShell Universal versions prior to 2026.1.3

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-3277 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3277

Vulnerability Analysis

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). The core issue stems from PowerShell Universal's handling of OIDC authentication credentials during configuration. When administrators configure OIDC authentication, the client secret—a critical credential used to authenticate the application to the identity provider—is written directly to the authentication.ps1 configuration script without any encryption or obfuscation.

The attack requires an adversary to have read access to the file system where PowerShell Universal is installed. This could be achieved through various means: a low-privileged local user, a compromised web application on the same system, directory traversal vulnerabilities, or misconfigured file permissions. Once the attacker obtains read access to .universal/authentication.ps1, they can extract the OIDC client secret in plaintext.

Root Cause

The root cause is improper secret management within the PowerShell Universal configuration framework. Instead of leveraging secure credential storage mechanisms such as the Windows Credential Manager, encrypted configuration stores, or environment variable references, the application directly embeds the sensitive OIDC client secret as plaintext within a PowerShell script file. This design decision violates the principle of secure credential handling and fails to implement defense-in-depth for sensitive authentication material.

Attack Vector

An attacker exploiting this vulnerability would follow these steps:

1. Gain read access to the PowerShell Universal installation directory through legitimate access, privilege escalation, or another vulnerability
2. Navigate to the .universal/ configuration directory
3. Read the contents of authentication.ps1
4. Extract the OIDC client ID and client secret from the configuration
5. Use the obtained credentials to authenticate as the application to the OIDC provider, potentially gaining access to protected resources or user data

The vulnerability is particularly dangerous in multi-tenant environments or systems where multiple users or applications share the same server, as any account with read permissions to the configuration directory can compromise the authentication credentials.

Detection Methods for CVE-2026-3277

Indicators of Compromise

• Unexpected read access to .universal/authentication.ps1 files by unauthorized users or processes
• Authentication events from unusual IP addresses or locations using the legitimate OIDC client credentials
• Anomalous OIDC token requests that don't correlate with expected application behavior
• File access audit logs showing repeated reads of the authentication configuration file

Detection Strategies

• Enable file system auditing on the .universal/ directory and monitor for read access from non-service accounts
• Implement SIEM rules to correlate OIDC authentication events with expected application server IP addresses
• Monitor for OIDC token requests originating from unexpected network segments or geographic locations
• Review access control lists on PowerShell Universal configuration directories to identify overly permissive settings

Monitoring Recommendations

• Configure Windows Security Event Logging (Event ID 4663) for object access on the authentication configuration file
• Implement identity provider logging to track all OIDC client credential usage and flag anomalies
• Use endpoint detection and response (EDR) tools to monitor process access to sensitive configuration files
• Establish baseline behavior for OIDC authentication patterns and alert on deviations

How to Mitigate CVE-2026-3277

Immediate Actions Required

• Upgrade PowerShell Universal to version 2026.1.3 or later immediately
• Rotate all OIDC client secrets after upgrading to invalidate any potentially compromised credentials
• Review file system permissions on the .universal/ directory and restrict read access to only necessary service accounts
• Audit system access logs to determine if unauthorized users accessed the configuration file prior to patching

Patch Information

The vulnerability is addressed in PowerShell Universal version 2026.1.3. Administrators should upgrade to this version or later as soon as possible. For detailed patch information and upgrade instructions, refer to the Devolutions Security Advisory.

After upgrading, it is critical to rotate your OIDC client secrets at your identity provider. The upgraded version should implement proper secret storage, but any secrets that were previously stored in cleartext should be considered compromised.

Workarounds

• Immediately restrict file system permissions on .universal/authentication.ps1 to only the PowerShell Universal service account
• Consider implementing additional access controls such as Windows ACLs or mandatory access control policies
• Move the OIDC client secret to environment variables or a secure secrets management solution if supported by your version
• Temporarily disable OIDC authentication and use alternative authentication methods until the patch can be applied

# Restrict file permissions on Windows (PowerShell)
# Run as Administrator to secure the authentication configuration
$configPath = "C:\ProgramData\PowerShellUniversal\.universal\authentication.ps1"
$acl = Get-Acl $configPath
$acl.SetAccessRuleProtection($true, $false)
$serviceAccount = New-Object System.Security.AccessControl.FileSystemAccessRule("NT SERVICE\PowerShellUniversal", "Read,Write", "Allow")
$administrators = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators", "FullControl", "Allow")
$acl.AddAccessRule($serviceAccount)
$acl.AddAccessRule($administrators)
Set-Acl $configPath $acl