CVE-2026-12162

MEDIUM

Devolutions Remote Desktop Manager 2026.2.0-2026.2.8 - Credential Disclosure via Social Login Autofill Bypass

Title source: llm

Description

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

References (1)

Core 1

Core References

https://devolutions.net/security/advisories/DEVO-2026-0018/

Scores

CVSS v3 5.5

EPSS 0.0015

EPSS Percentile 4.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-297

Status published

Products (2)

Devolutions/Remote Desktop Manager 2026.2.0 - 2026.2.8

devolutions/remote_desktop_manager < 2026.2.9.0

Published Jun 16, 2026

Tracked Since Jun 16, 2026