This vulnerability involves the insertion of sensitive information into sent data within the automation jobs API of Devolutions PowerShell Universal versions 2026.2.2 and earlier. An authenticated user who has scoped job or script read permissions can exploit this flaw to obtain OAuth refresh tokens belonging to other users. The root cause is the failure to strip the refresh token from job read responses, leading to unauthorized disclosure of sensitive credentials.

The impact is unauthorized disclosure of OAuth refresh tokens, which could allow an attacker with read permissions to impersonate other users or access resources on their behalf. This compromises user confidentiality and potentially leads to further unauthorized actions within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read permissions to trusted users only and monitor for unusual access patterns involving the automation jobs API.