CVE-2026-3224

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0005/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:43

Type	Values Removed	Values Added
Summary		(es) Omisión de autenticación en el modo de autenticación de Microsoft Entra ID (Azure AD) en Devolutions Server 2025.3.15.0 y versiones anteriores permite a un usuario no autenticado autenticarse como un usuario arbitrario de Entra ID mediante un JSON Web Token (JWT) falsificado.

05 Mar 2026, 15:05

Type	Values Removed	Values Added
References	~~() https://devolutions.net/security/advisories/DEVO-2026-0005/ -~~	() https://devolutions.net/security/advisories/DEVO-2026-0005/ - Vendor Advisory
CPE		cpe:2.3:a:devolutions:devolutions_server::::::::
First Time		Devolutions Devolutions devolutions Server

04 Mar 2026, 15:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

03 Mar 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-03 22:16

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3224

Mitre link : CVE-2026-3224

CVE.ORG link : CVE-2026-3224

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-3224", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3224", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T14:42:25.099661Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.3.15.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-03T22:16:29.523", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0005/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT)."}, {"lang": "es", "value": "Omisi\u00f3n de autenticaci\u00f3n en el modo de autenticaci\u00f3n de Microsoft Entra ID (Azure AD) en Devolutions Server 2025.3.15.0 y versiones anteriores permite a un usuario no autenticado autenticarse como un usuario arbitrario de Entra ID mediante un JSON Web Token (JWT) falsificado."}], "lastModified": "2026-06-17T10:43:14.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A29A5DF-C6FB-4E5C-A0B2-7C04472C9DF2", "versionEndExcluding": "2025.3.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}