CVE-2026-9245CWE-601

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…

Medium · published May 22, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link.

This issue affects :

* Devolutions Server 2026.1.6.0 through 2026.1.16.0

* Devolutions Server 2025.3.20.0 and earlier

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-22T15:24Z
EPSS history
Timeline
  • 22 MAY 15:24Z
    Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…
    cvelistv5