| Package | Affected versions | Patched versions |
|---|---|---|
| devolutions server | ≥ 2026.1.6.0, < 2026.1.12.0 | 2026.1.12.0 |
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free