CVE-2026-9226

Executive Summary

CVE-2026-9226 is an authentication bypass in the Azure AD external login flow of Devolutions Server 2026.3.7.0 and earlier. A remote, unauthenticated attacker can take over a user's account by replaying a captured login-session token that is exposed in a redirect URL. Any organization that has deployed Devolutions Server with Azure AD as an external identity provider and permits remote network access to the login endpoint is exposed to full account compromise, with no vendor patch currently available.

Technical Analysis

Devolutions Server supports external authentication through Azure AD (Entra ID), an OpenID Connect / OAuth-style federation flow in which the Devolutions Server login endpoint acts as the relying party. In a correctly implemented authorization-code or implicit flow, the sensitive artifact used to complete the login — a session, state, or authorization token — is transmitted to the relying party through a controlled channel and bound to the user's browser session, then consumed once on a single successful callback.

The NVD description states that in Devolutions Server 2026.3.7.0 and earlier the Azure AD external login flow exposes a captured login-session token in a redirect URL, and that this token can be replayed by a remote attacker to take over the user's account. The vulnerability class is CWE-294: Authentication Bypass by Capture-replay. The weakness is therefore twofold: the login-session token is disclosed to parties who can observe the redirect (a URL containing the token can be captured from browser history, proxy logs, referrer headers, shared links, or network observation), and the server accepts that token again without adequate binding to the original browser session, without single-use enforcement, and/or without a valid freshness window.

Because the vulnerable component is the Azure AD external login flow, the attack surface is the Devolutions Server web login entry point and the callback handler that processes the federated response. Exploitation does not require credentials, does not require user interaction beyond the victim's normal use of the login page (the captured token is generated by a legitimate user's login), and produces a fully authenticated session as the victim. No code-level details — function names, endpoint paths, or parameter names — beyond the redirect-URL token exposure described in the NVD advisory are available, and none are asserted here.

The fact that no patch, no workaround, and no affected-version metadata beyond the vendor version ceiling have been published increases operational risk: defenders cannot rely on a version delta to know which assets are safe.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available; the attack chain below is inferred strictly from the NVD description and the CWE-294 vulnerability class.

1. Reconnaissance / target identification. The attacker identifies internet-reachable Devolutions Server instances configured with Azure AD external login. This is typically done through passive fingerprinting of the login page and TLS certificate metadata (see Shodan dorks in METADATA) or by targeting organizations already known to use Devolutions for privileged-access management. Preconditions are: external Azure AD login enabled, the victim user exists and can authenticate, and the attacker obtains the intercepted token.

2. Triggering the flaw class. The attacker obtains a captured login-session token from a redirect URL produced during a legitimate Azure AD external login. Because the token is exposed in the URL, it can leak through any channel that observes or stores URLs — a shared or logged redirect, browser history, an intermediary proxy, a referrer header, or network traffic in the attacker's view. The attacker does not need to induce malformed input; the flaw is in how the token is disclosed and how the server subsequently validates it.

3. Replay / execution. The attacker replays the captured token against the Devolutions Server external login flow. Per the NVD description, the server does not sufficiently bind the token to the originating browser session or invalidate it after first use, so the replay is accepted and a valid authenticated session is established in the attacker's context.

4. Post-exploitation impact. Successful replay yields account takeover of the victim's Devolutions Server account. Given that Devolutions Server is a privileged-access and credential-management platform, a hijacked session can expose stored credentials, sessions, and the ability to pivot to managed endpoints. The attacker inherits whatever role and permissions the victim holds, including administrative access if the compromised user is privileged.

Impact Assessment

The vulnerability enables full account takeover of Devolutions Server users authenticated via Azure AD, through replay of a captured login-session token. Impact is governed by the disclosed CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N (network attack vector, high complexity, no privileges required, user interaction required, changed scope, high confidentiality and integrity impact, no availability impact). The high complexity and required user interaction reflect the need to first capture a valid token from a redirect URL; once captured, the bypass itself requires no credentials and no victim action beyond a normal login.

Blast radius is defined by which accounts use Azure AD external login and what those accounts can reach. Because Devolutions Server is used to broker access to privileged credentials and remote sessions, a single hijacked account can provide lateral movement into managed infrastructure, credential stores, and downstream systems. The changed-scope rating indicates the compromise can affect resources beyond the vulnerable component's security authority — consistent with pivoting from the login flow into the wider protected environment.

Business impact includes unauthorized access to privileged credentials, potential lateral movement, regulatory exposure from a confidentiality and integrity breach, and loss of trust in the federated-authentication control. With no patch, no workaround, and CVE-2026-9226 not listed in CISA KEV, the residual risk remains open until the vendor provides remediation. No exploit-in-the-wild evidence or threat-actor attribution is currently available.

Detection Guidance

Sigma Rule

title: Possible Replay of Devolutions Server Azure AD External Login Token
id: 9f3c1a7e-2b64-4d1e-8a52-6c0e5f7b1d90
status: experimental
description: Detects repeated or suspicious external-login callbacks consistent with replay of a captured Azure AD login-session token against Devolutions Server.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-9226
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: windows
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/login'
      - '/signin-oidc'
      - '/account/external'
  selection_indicators:
    cs-uri-query|contains:
      - 'code='
      - 'token='
      - 'session='
  timeframe: 5m
  condition: selection_path and selection_indicators | count() by src_ip > 10
fields:
  - src_ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate repeated logins behind NAT
  - Load-balancer health checks (normally excluded by URI filters)
level: high
tags:
  - attack.t1078
  - cve.2026-9226

YARA Rule

rule CVE_2026_9226_Devolutions_AzureAD_Login_Replay
{
    meta:
        author = "valtersit.com"
        description = "Detects indicators of Azure AD external login token exposure/replay against Devolutions Server"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-9226"
        cve = "CVE-2026-9226"
        date = "2026-01-01"

    strings:
        $azure1 = "login.microsoftonline.com" nocase
        $azure2 = "external login" nocase
        $dvls = "Devolutions Server" nocase
        $param1 = "code=" ascii wide
        $param2 = "session_token" nocase ascii wide
        $redirect = "redirect_uri=" nocase ascii wide

    condition:
        ($azure1 or $dvls) and $redirect and any of ($param*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-9226 Devolutions Server Azure AD external login token replay attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"login"; nocase; http.uri; content:"code="; nocase; http.uri; content:"redirect_uri="; nocase; threshold:type both, track by_src, count 15, seconds 300; reference:cve,2026-9226; classtype:attempted-user; sid:20269226; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and url.path : ("*login*", "*signin-oidc*") and url.query : ("*code=*", "*token=*") ]
  [ network where network.protocol == "http" and url.path : ("*login*", "*signin-oidc*") and url.query : ("*code=*", "*token=*") ]

Splunk SPL Query

index=web (cs_uri_stem="/login*" OR cs_uri_stem="*signin-oidc*" OR cs_uri_stem="*external*")
  (cs_uri_query="*code=*" OR cs_uri_query="*token=*" OR cs_uri_query="*session=*")
| stats count values(cs_uri_stem) as paths values(cs_uri_query) as queries by src_ip
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="web,devolutions,cve-2026-9226,">
  <rule id="2026926" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.*(login|signin-oidc|external).*</field>
    <field name="url">.*(code|token|session)=.*</field>
    <description>CVE-2026-9226: Suspicious Devolutions Server Azure AD external login callback (possible token replay).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata beyond the version ceiling (2026.3.7.0 and earlier) has been published.

1. Immediate mitigations

   • Restrict network access to the Devolutions Server login and external-login callback endpoints to trusted networks and authorized user populations; do not expose Azure AD external login broadly to the internet where avoidable.
   • Prevent URL/token leakage: disable or sanitize redirects that carry login-session tokens, strip query strings from referrer propagation, and ensure tokens are never placed in URLs that may be logged, cached, or shared.
   • Reduce token validity windows and enforce single-use consumption at the reverse proxy or access layer where possible; invalidate active sessions and force re-authentication across the tenant if compromise is suspected.
   • Monitor and alert on repeated external-login callbacks and anomalous session establishment (see Detection Guidance).
   • Where practical, require phishing-resistant MFA and conditional-access policies on the Azure AD side to reduce the value of a hijacked login session.

2. Patch / upgrade steps

   • No patch currently exists. Monitor the vendor (Devolutions) advisory channel and the NVD entry for CVE-2026-9226; apply the vendor's fixed build as soon as it is released. Because patch confidence is 0/4, do not assume that any specific version above 2026.3.7.0 is remediated until the vendor confirms it.

3. Long-term hardening

   • Enforce cryptographically bound, single-use, short-lived login-session tokens throughout federated authentication flows (state/nonce binding, PKCE, session-bound tokens).
   • Adopt least-privilege for Devolutions Server accounts and segment privileged access so a single hijacked session cannot reach the entire credential store.
   • Centralize authentication logs and retain them for retroactive hunting; periodically test external login flows for capture-replay weaknesses.
   • Maintain an asset inventory of Devolutions Server instances with Azure AD external login enabled so remediation can be applied quickly once a patch is available.

References

• NVD — CVE-2026-9226: https://nvd.nist.gov/vuln/detail/CVE-2026-9226
• CWE-294 — Authentication Bypass by Capture-replay: https://cwe.mitre.org/data/definitions/294.html
• Devolutions — vendor security advisories: https://devolutions.net/security/advisories/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-9226 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• OpenID Foundation — OAuth 2.0 Security Best Current Practice (token binding and replay prevention): https://openid.net/specs/openid-connect-security-best-practices.html

No public exploit code, PoC, Nuclei template, or exploit-in-the-wild evidence is currently associated with CVE-2026-9226. No threat-actor campaign has been attributed.