{"data":{"id":"f6702ff7-93f6-48fd-bf5f-d29ecaa220ba","title":"CVE-2026-13437: Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0…","summary":"CVE-2026-13437 affects the AI Agent job API in Devolutions PowerShell Universal 2026.2.0. An authenticated user with AI Agent read access can obtain App Tokens, which are serialized in plaintext in job API responses, and these tokens are reusable and may carry higher privileges than the user's own. The weakness is classified as CWE-201, Insertion of Sensitive Information Into Sent Data.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13437","publishedAt":"2026-06-29T16:16:35.773Z","cveId":"CVE-2026-13437","cweIds":["CWE-201"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["PowerShell Universal AI Agent job API"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Devolutions PowerShell Universal leaks App Tokens in AI Agent job API responses","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00438,"epssCheckedAt":"2026-10-14T18:05:59.791Z","kevDateAdded":null,"advisoryAliases":["GHSA-fw4j-fj8v-q67w"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:18.644Z","patchAvailable":null,"disclosureDate":"2026-06-29T16:16:35.773Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}