CoreCVE
Back

MEDIUM

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365

Published Mar 5, 2024

Description

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365.

The user will stay authenticated until the Devolutions Server token expiration.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-613

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner DEVOLUTIONS
Published Mar 5, 2024
Updated Nov 1, 2024
Reserved Feb 26, 2024
Link CVE-2024-1900
CISA Vulnrichment
Updated Mar 6, 2024
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2024-1900
Red Hat
Severity n/a
Public date n/a
Links CVE-2024-1900