CVE-2026-110805

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

CVE-2026-110805

A Server-side request forgery (SSRF) vulnerability exists in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier . This flaw allows an authenticated low-privileged user to exfiltrate stored PingOne application secrets by providing an attacker-controlled PingOne confi...

CVE-2026-110805

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

EUVD-2026-102877

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

PT-2026-115608

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.8.1 Description An authenticated low-privileged user can perform a Server-side request forgery SSRF via the PingOne groups endpoint. This occurs when an attacker-controlled PingOne configuration is...

CVE-2026-110805: Server-Side Request Forgery (SSRF)

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

Devolutions Server: Server Request Forgery Vulnerability

Devolutions Server 2026.3.8.0 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from server-side request forgeing in PingOne groups endpoints. Low-privilege users who are authenticated can steal the stored PingOne application keys by manipulating the...