CVE-2026-13437_CVE-2026-13437

6.5 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

Basic Information

ID CVE-2026-13437

Source DEVOLUTIONS

Published Jun 29, 2026 at 15:23

Modified Jun 29, 2026 at 16:25

Affected Product

Vendor Devolutions

Product PowerShell Universal

Version 2026.2.0

Affected Versions Devolutions PowerShell Universal 2026.2.0

CWE Classification

CWE-201

References

devolutions.net /security/advisories/DEVO-2026-0022/

{
    "lastseen": "",
    "description": "Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.",
    "published": "2026-06-29T15:23:53.472Z",
    "modified": "2026-06-29T16:25:22.355Z",
    "type": "cve",
    "title": "CVE-2026-13437",
    "source": "DEVOLUTIONS",
    "references": "https://devolutions.net/security/advisories/DEVO-2026-0022/",
    "id": "CVE-2026-13437",
    "bulletinFamily": "",
    "cwe": [
        "CWE-201"
    ],
    "cvelist": null,
    "sourceData": "Devolutions PowerShell Universal 2026.2.0",
    "sourceHref": "",
    "cvss": {
        "score": 6.5,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "PowerShell Universal",
    "version": "2026.2.0",
    "vendor": "Devolutions",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}