CVE-2026-105485

Executive Summary

CVE-2026-105485 is an authentication bypass vulnerability in the OAuth device authorization flow of Devolutions Server 2026.3.7.0 and earlier. A remote, unauthenticated attacker can capture a device verification link and, through replay of that link when an authenticated victim interacts with it, take over the victim's account. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium severity), reflecting high confidentiality and integrity impact with no availability impact, and is currently unpatched with no known public exploit or proof-of-concept.

Technical Analysis

The vulnerability resides in the OAuth device authorization flow implementation of Devolutions Server. The OAuth 2.0 Device Authorization Grant (RFC 8628) is designed for input-constrained devices, where a client obtains a device code and user code, then instructs the user to visit a verification URI and enter the user code to authorize the device. CVE-2026-105485 maps to CWE-294: Authentication Bypass by Capture-replay.

The core mechanism, as described by the NVD, involves the replay of a "captured device verification link." In the standard device authorization flow, the device verification link is a URL presented to the user to complete authorization. If this link can be captured and later replayed, the flow does not adequately bind the verification attempt to the legitimate initiating device or to a single-use, time-bound nonce. An attacker who captures such a link can cause an authenticated victim to authorize the attacker's session or device, resulting in account takeover of the victim.

The attack requires user interaction (UI:R) and is assessed as high complexity (AC:H), consistent with the need to capture a valid device verification link and induce a victim to act on it. The attack vector is network (AV:N) with no privileges required (PR:N). Because the impact is scoped to the vulnerable component (S:U) — the OAuth authorization state — confidentiality and integrity are rated High (C:H/I:H), while availability is unaffected (A:N).

The exact internal implementation details of the device authorization flow in Devolutions Server — including the specific token handling, link generation parameters, and validation routines — are not disclosed in the available NVD description. No function names, endpoints, or parameters are provided verbatim in the intelligence data; therefore, this report does not speculate on those specifics. The analysis remains at the vulnerability-class level: a replay weakness in the device verification link lifecycle enabling authentication bypass.

Affected product versions are stated as Devolutions Server 2026.3.7.0 and earlier. No OSV packages, workarounds, or vendor fixes are identified in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-294 capture-replay in an OAuth device authorization flow).

1. Reconnaissance / target identification. The attacker identifies an internet-facing Devolutions Server instance running version 2026.3.7.0 or earlier. Shodan can be used to locate exposed instances via HTTP title or HTML fingerprints.

2. Link capture. During the device authorization flow, a device verification link is generated for the initiating session. An attacker positioned to observe or obtain this link (for example, via interception, logging, referrer leakage, or social engineering) captures it before it is consumed or expires.

3. Triggering the flawed flow. The attacker causes the captured device verification link to be replayed in the context of an authenticated victim — for example, by inducing the victim to open the link (UI:R) while logged in to Devolutions Server. Because the flow lacks adequate anti-replay binding, the authorization is accepted.

4. Post-exploitation impact. Successful replay of the device verification link results in the attacker's device or session being authorized against the victim's account, achieving account takeover of that user (high confidentiality and integrity impact). The attacker can then access resources and data available to the compromised account.

This scenario depends on the attacker's ability to capture a valid link and on victim interaction; these constraints explain the high attack complexity and required user interaction in the CVSS vector.

Impact Assessment

A successful exploit enables takeover of a user's account on Devolutions Server, a privileged-access and remote-connection management platform where accounts frequently hold sensitive credentials and infrastructure access. The CVSS v3.1 base score is 6.8 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N:

• Confidentiality: High — the attacker gains access to data and secrets associated with the victim's account.
• Integrity: High — the attacker can act as the victim and modify account-linked resources.
• Availability: None — no direct denial of service is indicated.
• Scope: Unchanged — impact is confined to the vulnerable authorization component and the victim account.

The blast radius is limited to users whose device verification links are captured and replayed, but the value of accounts on a privileged-access management server raises the effective business risk. EPSS is not yet scored by FIRST.org, and CISA KEV does not list this CVE. No exploit code or Nuclei template is currently available.

Detection Guidance

Sigma Rule

title: Devolutions Server OAuth Device Verification Link Replay (CVE-2026-105485)
id: 9f2c1a74-0b3e-4d51-8a6f-cve2026105485
status: experimental
description: Detects potential replay of an OAuth device verification link indicative of CVE-2026-105485 account takeover attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105485
author: valtersit.com
date: 2026-01-01
logsource:
  product: devolutions
  service: server
detection:
  selection_flow:
    event_type:
      - 'oauth.device.authorization'
      - 'oauth.device.verify'
  selection_replay:
    result:
      - 'success'
    anomaly:
      - 'replayed_link'
      - 'reused_verification'
  condition: selection_flow and selection_replay
falsepositives:
  - Legitimate device authorization completions
level: medium
tags:
  - attack.t1078
  - cve.2026-105485

YARA Rule

rule CVE_2026_105485_Devolutions_Device_Auth_Replay
{
    meta:
        description = "Detects references to OAuth device verification link replay impacting Devolutions Server (CVE-2026-105485)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105485"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $flow1 = "device_authorization" ascii nocase
        $flow2 = "device_verification" ascii nocase
        $flow3 = "device_code" ascii nocase
        $dev  = "Devolutions" ascii nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or filesize < 10MB
        and $dev and 2 of ($flow*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105485 Devolutions Server OAuth Device Verification Link Replay Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"device"; nocase; content:"verify"; nocase; http.uri; pcre:"/(device|verification)[^\\r\\n]{0,64}(code|link)/i"; reference:cve,2026-105485; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105485; classtype:attempted-user; sid:2026105485; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.action == "device_authorization_initiated" ]
  [ authentication where event.action in ("device_authorization_verified", "device_verification_completed") and event.outcome == "success" ]

Splunk SPL Query

index=devolutions sourcetype=devolutions:oauth
(device_authorization OR device_verification OR device_code)
| stats count min(_time) as first_seen max(_time) as last_seen values(action) as actions by src_ip, user, device_code
| where count > 1
| eval cve="CVE-2026-105485"
| table first_seen, last_seen, src_ip, user, device_code, count, actions, cve

Wazuh OSSEC Rule

<group name="devolutions,oauth,">
  <rule id="105485" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">device_authorization|device_verification</field>
    <field name="result">success</field>
    <description>CVE-2026-105485: Possible Devolutions Server OAuth device verification link replay / account takeover attempt.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network exposure of the Devolutions Server web interface; avoid direct internet-facing access and require access through a VPN or zero-trust gateway.
   • If the device authorization flow is not required, disable it where configuration permits to remove the attack surface.
   • Monitor OAuth device authorization and verification events for anomalous or repeated verification-link activity.
   • Enforce strong multi-factor authentication and privileged-access controls to reduce the impact of account takeover.
   • Educate users not to open device verification links received from untrusted or unexpected sources.

2. Patch / upgrade steps

   • No vendor fix is currently identified in the tracked sources. Monitor Devolutions' vendor advisories and release notes for a security update addressing CVE-2026-105485.
   • Once a fixed version is released, upgrade Devolutions Server 2026.3.7.0 and earlier to the patched release promptly and validate the device authorization flow.

3. Long-term hardening

   • Ensure OAuth device verification links are single-use, short-lived, and bound to the initiating device and session; require confirmation of the user code rather than trusting a link alone.
   • Centralize logging of authentication and authorization flows into the SIEM and alert on replay indicators.
   • Conduct periodic reviews of authentication flows and coordinate with the vendor for advisories.

References

• NVD — CVE-2026-105485: https://nvd.nist.gov/vuln/detail/CVE-2026-105485
• CWE-294 — Authentication Bypass by Capture-replay: https://cwe.mitre.org/data/definitions/294.html
• RFC 8628 — OAuth 2.0 Device Authorization Grant: https://datatracker.ietf.org/doc/html/rfc8628
• Devolutions security advisories (vendor advisory portal — monitor for CVE-specific guidance)
• CISA Known Exploited Vulnerabilities catalog: Not listed as of this report (no exploit-in-the-wild evidence identified)