CVE-2026-5175
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors…
Published: 2026-04-01 · CVSS: 5.0 · CVSS 3.1
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7