low2.6
CVE-2026-110805
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate t…
Impact
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Devolutions | Devolutions Server | before 2026.2.20.0 from 2026.3.5.0 before 2026.3.10.0 |