CVE-2026-16798

MEDIUM

Devolutions PowerShell Universal < 2026.2.3 - Insertion of Sensitive Information Into Sent Data

Title source: rule

Description

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

References (1)

Core 1

Core References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Scores

CVSS v3 6.5

EPSS 0.0022

EPSS Percentile 13.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-201

Status published

Products (2)

Devolutions/PowerShell Universal < 2026.2.3

devolutions/powershell_universal < 2026.2.3.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026