CVE-2026-12162
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.
Risk Assessment
The organization may be exposed to credential theft, leading to unauthorized access to social accounts and potential financial losses.
Recommendation
It is recommended to update Devolutions Remote Desktop Manager to the latest version to mitigate this vulnerability and implement additional security mechanisms for host validation.
Original NVD description (English source)
Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.