Description
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Server | < 2026.3.13.0 | 2026.3.13.0 |
Advisories 1
- WID-SEC-2026-4306 Devolutions Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026