← Back
2026-03-03 21:21CVE-2026-3224DEVOLUTIONS
PUBLISHED5.2CWE-287

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

Problem type

Affected products

Devolutions

Server

<= 2025.3.15.0 - AFFECTED

References

devolutions.net

https://devolutions.net/security/advisories/DEVO-2026-0005/

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-3224
Click to expand
{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-3224",
    "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
    "assignerShortName": "DEVOLUTIONS",
    "dateUpdated": "2026-03-03T21:21:27.611Z",
    "dateReserved": "2026-02-25T18:56:18.991Z",
    "datePublished": "2026-03-03T21:21:27.611Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
        "shortName": "DEVOLUTIONS",
        "dateUpdated": "2026-03-03T21:21:27.611Z"
      },
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).</p>"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Devolutions",
          "product": "Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "2025.3.15.0"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-287 Improper Authentication, CWE-347: Improper Verification of Cryptographic Signature",
              "cweId": "CWE-287",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://devolutions.net/security/advisories/DEVO-2026-0005/"
        }
      ]
    }
  }
}