CVE-2026-4927 - AskarLabs CVE Database

CVE-2026-4927

Vendor Devolutions

Product Server

Weakness CWE-201

Published April 1, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-4927 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Related vulnerabilities

04Related CVE

CVE-2026-4035 Environment Variable Resolution Vulnerability in mlflow/mlflow CVE-2026-42539 IRIS has an Excessive Data Exposure issue CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users CVE-2026-48877 WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability CVE-2026-39480 WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability