Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a… (CVE-2026-9226)

CVE-2026-9226 describes an authentication bypass vulnerability in the Azure AD external login flow of Devolutions Server 2026.3.7.0 and earlier. The issue arises because a login-session token is exposed in a redirect URL, which can be captured and replayed by a remote attacker to gain unauthorized access to a user's account. The vulnerability has a CVSS 3.1 base score of 6.8, with attack vector being adjacent network, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

A remote attacker can take over a user's account by replaying a captured login-session token exposed in a redirect URL during the Azure AD external login flow. This compromises the confidentiality and integrity of the affected user's account without requiring user interaction or privileges. There is no known exploitation in the wild at this time.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing login-session tokens in URLs and consider additional monitoring or compensating controls for Azure AD external login flows.