CVE-2026-123545

The software OpenAM versions 14.5.1 before 16.1.4 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the OAuth 2.0 device authorization flow . The vulnerability occurs when consent is skipped for implied-consent clients, enabling an attacker to approve device codes without proper au...

CVE-2026-123542

OpenAM versions before 16.1.4 are vulnerable to a PKCE Bypass in the OAuth 2.0 Device Authorization Flow . The software fails to validate the code verifier when exchanging device codes for tokens. An attacker who retrieves an approved device code from client logs or shared device storage can rede...

CVE-2026-105485

The Devolutions Server (version 2026.3.7.0 and earlier) is susceptible to an authentication bypass within the OAuth device authorization flow . A remote attacker can achieve full account takeover of an authenticated victim by replaying a captured device verification link . The vulnerability is ca...

EUVD-2026-93782

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

PT-2026-106851

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...