Security & compliance

Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2026.3.12.0 and earlier allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.