CVE-2026-8407 — Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted req — CVE Database · The Intelligence Room