CVE-2026-9245: Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…

PriorityP429medium5CVSS 3.1

AVNACHPRNUIRSUCLILAL

EPSS

0.17%

6.6th percentile

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link.

This issue affects :

* Devolutions Server 2026.1.6.0 through 2026.1.16.0
* Devolutions Server 2025.3.20.0 and earlier

Affected

4 ranges

Vendor	Product	Version range	Fixed in
devolutions	devolutions_server	< 2025.3.22.0	2025.3.22.0
devolutions	devolutions_server	>= 2026.1.6.0 < 2026.1.19.0	2026.1.19.0
devolutions	server	<= 2025.3.20.0	—
devolutions	server	2026.1.6.0 – 2026.1.16.0	—

CVSS provenance

nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

cvelistv5v3.15.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.