CVE-2026-12162

5.5 MEDIUM

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disc...

Published: 2026-06-16 · Last updated: 2026-06-16

Severity and scoring

CVSS: 5.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE: CWE-297

Affected products

Vendor	Product
devolutions	remote_desktop_manager

Description

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-12162
[Vendor advisory]https://devolutions.net/security/advisories/DEVO-2026-0018/

Related CVEs

Same vendor

CVE-2026-12161 — Improper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user ... (8.8 HIGH)
CVE-2026-10787 — Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metad... (4.3 MEDIUM)
CVE-2026-10786 — Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain... (6.5 MEDIUM)
CVE-2026-10544 — Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an auth... (6.5 MEDIUM)
CVE-2026-9590 — Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user w... (5.3 MEDIUM)

Same CWE

CVE-2026-44393 — An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0 (7.4 HIGH)
CVE-2026-35563 — It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDA... (8.5 HIGH)
CVE-2026-42790 — Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints ... (8.1 HIGH)
CVE-2026-44467 — The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side (6.8 MEDIUM)
CVE-2025-25253 — An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and... (7.5 HIGH)