CVE-2026-3277 - AskarLabs CVE Database

CVE-2026-3277

Vendor Devolutions

Product PowerShell Universal

Weakness CWE-312 · Cleartext storage

Published February 27, 2026

Last update March 30, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

Key dates

02Disclosure timeline

February 27, 2026 CVE published

March 30, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3277 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/312.html

Related vulnerabilities

04Related CVE

CVE-2025-2909 Lack of encryption vulnerability in DuoxMe CVE-2022-2513 Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products CVE-2024-31486 CVE-2025-4394 Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability CVE-2024-58277 R Radio Network FM Transmitter 1.07 System Settings Disclosure