CVE-2026-3224

Devolutions Server versions 2025.3.15.0 and earlier are vulnerable to an authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated attacker can authenticate as an arbitrary Entra ID user by providing a forged JSON Web Token (JWT) to the /api/v1/login endpo...