Verified

CVE-2026-110805: Server 0 to before 2026.3.10

Affected technology

Server · 0 to before 2026.3.10
Devolutions

Description’s affected range: 2026.3.8.0 and earlier

Component: Not specified by the source

What an attacker can do

An authenticated low-privileged user can exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

Published 16-Oct-2026 14:29 UTC

CWE: CWE-918
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-16 14:28:47.130192+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-110805.html