PT-2026-99383

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An issue exists where two-factor authentication 2FA is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This...

CVE-2026-5175

An improper access control vulnerability exists in the multi-factor authentication (MFA) management API of Devolutions Server (versions 2026.1.6 through 2026.1.11 ). This flaw allows an authenticated attacker to send crafted HTTP requests to delete their own configured MFA factors, effectively re...

PT-2026-29542

Improper access control in the multi-factor authentication MFA management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from...