Devolutions Server exposes account secrets and SMTP password
A company account server can leak two-step login secrets and email passwords.
Summary
Several flaws in Devolutions Server let an attacker obtain users' TOTP secrets, the SMTP password, the DVLS service account's NetNTLMv2 hash, and other users' MFA secrets. Versions 2026.3.13.0 and earlier are affected.
Affected when
- Attacker with read access to the database or a database backup
- Authenticated low-privileged user
- Delegated permission to update users from the identity provider
- Access to the email configuration test action
What to do
Update to version 2026.3.13.0 or newer.
Products and platforms
CVE IDs
Sources
Times
First published
First seen