PatchTheCVECVE-2026-4829: Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier
CVE-2026-4829 is a medium-severity flaw (CVSS 5.4) affecting devolutions server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 94%) |
| CISA exploited list | No |
| Weakness | CWE-287 |
| Published | 2026-04-01 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-4829?
devolutions server: upgrade to 2026.1.12.0. Exact commands for each OS are on this page.
Is CVE-2026-4829 being exploited?
CVE-2026-4829 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-4829 affect?
CVE-2026-4829 affects devolutions server. Severity is medium (CVSS 5.4). Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an externa
How urgent is CVE-2026-4829?
Priority 20/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-6706 MEDIUM 6.5 UPGRADE Improper access control in the vault documentation feature in Devolutions Server allows an authenticated att
- CVE-2026-5175 MEDIUM 5.0 UPGRADE Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows a
- CVE-2026-4828 HIGH 8.2 UPGRADE Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a
- CVE-2026-4927 MEDIUM 6.5 UPGRADE Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user manage
- CVE-2026-4925 MEDIUM 5.0 UPGRADE Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass