Devolutions Server: Cleartext storage of TOTP shared secrets (CVE-2026-120733)

CVE-2026-120733 identifies a security vulnerability in Devolutions Server 2026.3.12.0 and earlier where TOTP shared secrets are stored in cleartext within the user account database. This occurs when an administrator saves a user, causing an unencrypted copy of the security key to be written to the database. An attacker with unauthorized read access to the application database or database backups can extract these secrets to facilitate MFA bypass or unauthorized access.

Impact

An attacker with read access to the underlying database or database backups can retrieve plaintext TOTP secrets, effectively neutralizing the security provided by multi-factor authentication for affected accounts.

Recommendation

• Upgrade Devolutions Server to the version containing the fix for CVE-2026-120733.
• Audit access controls for the database and backup locations to ensure only authorized service accounts and administrators have read access.
• Rotate TOTP secrets for all user accounts after patching to mitigate the risk of previously exposed secrets.
• Implement strict database logging to detect unauthorized read access or anomalous query patterns targeting the user account data.