CVE-2026-120733: Security vulnerability

Published Nov 3, 2026

Updated

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.

Event History

Nov 3, 2026

CVE Published

via MITRE·08:32 PM

Data Sourced

via MITRE·08:32 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs read access to the Devolutions Server database or to a database backup. The issue exposes users' TOTP shared secrets through an unencrypted copy of the security key.

What action triggers creation of the exposed data?

The unencrypted copy of the security key is written when an administrator saves a user. Systems where administrators have saved users may therefore contain the exposed data in the database or backups.

Are backups in scope?

Yes. An attacker with read access to a database backup can obtain users' TOTP shared secrets if the backup contains the unencrypted security-key copy.

CVE-2026-120733: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What action triggers creation of the exposed data?

Are backups in scope?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What action triggers creation of the exposed data?

Are backups in scope?