Vulnerability · Published May 22, 2026 · Assigned by DEVOLUTIONS
CVE-2026-9245
Medium 5.0
In plain English
A medium-severity open redirect in Server from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 86.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Server | 2026.1.6.0 – through 2026.1.16.00 – through 2025.3.20.0 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L