Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2026-9245

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DEVOLUTIONS

Description

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Devolutions Server

Default version status: unaffected

  • 2026.1.6.0 to ≤ 2026.1.16.0affected
  • 0 to ≤ 2025.3.20.0affected

References