Description
Improper access control in the social login connection endpoint in
Devolutions Server 2026.2.5 allows an authenticated vault member to
enumerate social login entry metadata to which they are not authorized
via a crafted API request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Devolutions Server | 2026.2.0 – < 2026.2.5 | 2026.2.5 |
Advisories 1
- WID-SEC-2026-1978 Devolutions Server: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 16, 2026