CVE-2026-100288 is a vulnerability in Devolutions Server (version 2026.3.5.0 and earlier) where sensitive information such as external identity provider tokens and active session identifiers are stored in cleartext in the database. An attacker who gains read access to the database can retrieve these sensitive tokens and session identifiers by directly inspecting the stored records. This issue is categorized under CWE-312 (Cleartext Storage of Sensitive Information).

An attacker with read access to the Devolutions Server database can obtain sensitive authentication tokens and session identifiers, potentially enabling unauthorized access or session hijacking. The impact depends on the attacker's ability to access the database but does not indicate remote exploitation without such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict database read access to trusted personnel only and monitor for unauthorized access attempts.