CVE-2026-3277: 
Ironman Software PowerShell Universal vulnerability analysis and mitigation

CVE-2026-3277 is a cleartext storage vulnerability in PowerShell Universal (by Ironman Software) where the OpenID Connect (OIDC) authentication configuration stores the OIDC client secret in plaintext within the .universal/authentication.ps1 script. Any attacker with read access to that file can retrieve the OIDC client credentials. All versions of PowerShell Universal before 2026.1.3 are affected. The vulnerability was published on February 27, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-312 (Cleartext Storage of Sensitive Information). When an administrator configures OIDC authentication in PowerShell Universal, the application writes the OIDC client secret directly into the .universal/authentication.ps1 PowerShell script without encryption or obfuscation. An attacker who gains read access to this file — through local file system access, a misconfigured file share, or another vulnerability — can extract the plaintext client secret and use it to impersonate the application against the OIDC provider. The advisory was assigned by Devolutions and references DEVO-2026-0006 (Devolutions Advisory, ENISA EUVD).

Successful exploitation allows an attacker to obtain valid OIDC client credentials, which can be used to authenticate to the configured identity provider as the PowerShell Universal application. This may enable unauthorized access to protected resources, impersonation of the application in OAuth/OIDC flows, and potential lateral movement within environments that trust the compromised OIDC client. The confidentiality impact is high, while integrity and availability are not directly affected by this vulnerability (Red Hat CVE).

Exploitation requires low privileges — specifically, read access to the .universal/authentication.ps1 file on the host running PowerShell Universal. There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, ENISA EUVD).

1. Reconnaissance: Identify systems running PowerShell Universal versions prior to 2026.1.3 that have OIDC authentication configured.
2. Gain file read access: Obtain read access to the server's file system through any available means — local access, a misconfigured file share, directory traversal, or another vulnerability.
3. Locate the configuration file: Navigate to the .universal/ directory within the PowerShell Universal installation and open authentication.ps1.
4. Extract the client secret: Read the plaintext OIDC client secret stored in the script file.
5. Abuse the credentials: Use the extracted client ID and client secret to authenticate against the configured OIDC/OAuth2 identity provider, potentially obtaining access tokens or impersonating the application (Devolutions Advisory).

• File System: Unexpected access or modification timestamps on .universal/authentication.ps1; presence of scripts or tools that read or copy this file.
• Logs: Unusual file access events logged for .universal/authentication.ps1 by the operating system audit subsystem (e.g., Windows Security Event ID 4663 for object access).
• Network: Unexpected OAuth2/OIDC token requests originating from IP addresses not associated with the PowerShell Universal server, using the application's client credentials.
• Identity Provider Logs: Authentication events from the OIDC client ID at unusual times or from unexpected source IPs, indicating potential credential abuse.

Upgrade PowerShell Universal to version 2026.1.3 or later, which addresses the cleartext storage of the OIDC client secret. As an interim workaround, restrict file system permissions on the .universal/authentication.ps1 file so that only the PowerShell Universal service account has read access. Additionally, consider rotating the OIDC client secret with the identity provider if unauthorized access to the file cannot be ruled out (Devolutions Advisory, ENISA EUVD).

The vulnerability was assigned and disclosed by Devolutions under advisory DEVO-2026-0006, and was subsequently tracked by ENISA under EUVD-2026-9030. Red Hat also published a CVE entry for awareness. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database aggregation (Devolutions Advisory, Red Hat CVE).