CVSS 2.6 (low) · published 2026-10-16
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
Affected products (NVD): devolutions devolutions_server
Fixed in (NVD): 2026.2.20.0, 2026.3.10.0
Weakness: CWE-918
Source: NVD CVE-2026-110805
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.