Devolutions PowerShell Universal OpenID Connect Client Secret Storage Vulnerability

A vulnerability exists in Devolutions PowerShell Universal versions prior to 2026.1.3, where the OpenID Connect (OIDC) client secret is stored in cleartext within the .universal/authentication.ps1 script. This exposure allows an attacker with read access to the file to retrieve the OIDC client credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized access to OIDC client credentials, allowing an attacker to impersonate the client or access resources on behalf of the client.

Remediation

Users are advised to upgrade to Devolutions PowerShell Universal version 2026.1.3 or later.