CVE Feed

    Dashboard / CVE / CVE-2026-3277

    CVE-2026-3277

    The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

    Published:Feb 27, 2026
    Last Modified:Apr 16, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00009
    CVSS Score:5.5

    Affected Products

    Vendor
    Devolutions
    Product
    Powershell Universal
    Vendor
    Ironmansoftware
    Product
    Powershell Universal

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-37 Retrieve Embedded Sensitive Data

    Related CVEs

    CVE-2026-19768 (CVSS 8.1) — Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Un…
    CVE-2026-16802 (CVSS 6.5) — Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2…
    CVE-2026-16801 (CVSS 8.8) — Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell U…
    CVE-2026-16800 (CVSS 8.8) — Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Un…
    CVE-2026-16799 (CVSS 5) — Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 202…
    CVE-2026-16798 (CVSS 6.5) — Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Univers…
    CVE-2026-13437 (CVSS 6.5) — Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal …
    CVE-2026-8694 (CVSS 5.3) — Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated rem…
    CVE-2026-3563 (CVSS 5.5) — Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allo…
    CVE-2026-4064 (CVSS 8.3) — Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High