CVE-2026-13437 - AskarLabs CVE Database

CVE-2026-13437

Vendor Devolutions

Product PowerShell Universal

Weakness CWE-201

Published June 29, 2026

Last update June 29, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

Key dates

02Disclosure timeline

June 29, 2026 CVE published

June 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13437 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Related vulnerabilities

04Related CVE

CVE-2026-42379 WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability CVE-2025-62309 HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. CVE-2026-4525 Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header CVE-2026-45215 WordPress WP EasyPay plugin <= 4.3.0 - Sensitive Data Exposure vulnerability CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens