CVE-2026-8407 - AskarLabs CVE Database

CVE-2026-8407

Vendor Devolutions

Product Server

Weakness CWE-862 · Missing authorization

Published May 12, 2026

Last update May 13, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier

Key dates

02Disclosure timeline

May 12, 2026 CVE published

May 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-8407 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-3295 User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion CVE-2026-32515 WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability CVE-2025-10352 Missing Authorization vulnerability in Melis Platform CVE-2025-67929 WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability CVE-2026-45085 Discourse: Chat misauthorization and information disclosure

Identifiers

CVE CVE-2026-8407

CWE CWE-862

Affected versions

Vendor Devolutions

Product Server

Affected ≥ 2026.1.6.0 and ≤ 2026.1.11.0

Vendor Devolutions

Product Server

Affected ≤ 2025.3.16.0