CVE-2026-4829 - AskarLabs CVE Database

CVE-2026-4829

Vendor Devolutions

Product Server

Weakness CWE-287 · Improper authentication

Published April 1, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-4829 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2022-41737 IBM Spectrum Scale security bypass CVE-2025-14716 Unauthorized access to information CVE-2025-54888 @fedify/fedify: Improper Authentication and Incorrect Authorization CVE-2023-46290 Rockwell Automation FactoryTalk Services Platform Elevated Privileges Vulnerability CVE-2025-4978 Netgear DGND3700 Basic Authentication BRS_top.html improper authentication