CVE-2026-16798

EUVD-2026-48605
Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
DEVOLUTIONSCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
devolutionspowershell_universal
𝑥
< 2026.2.3
CNA
Common Weakness Enumeration
References
https://devolutions.net/security/advisories/DEVO-2026-0025/