Devolutions Server vulnerabilities

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server versions 2026.1.6 through 2026.1.11.

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF) via a crafted API request, potentially leading to information disclosure. This affects versions 2026.1.1 through 2026.1.11 and 2025.3.1 through 2025.3.17.

In Devolutions Server versions 2026.1.6 through 2026.1.11, exposure of sensitive information in the users MFA feature allows users with user management privileges to obtain other users' OTP keys via an authenticated API request.

Devolutions Server versions 2026.1.6 through 2026.1.11 have improper access control in the users MFA feature. An authenticated user can bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request.

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.

Exposure of credentials in unintended requests in Devolutions Server and Remote Desktop Manager on Windows. This issue affects Devolutions Server through 2025.3.8.0 and Remote Desktop Manager through 2025.3.23.0.

Devolutions Server exposes email service credentials to users without administrative rights. This issue affects versions before 2025.2.21 and before 2025.3.9.

Devolutions Server exposes credentials in unintended requests. The issue affects Server through 2025.2.20 and through 2025.3.8.

SQL Injection vulnerability in last usage logs in Devolutions Server. This issue affects Devolutions Server through 2025.2.20 and through 2025.3.8.

In Devolutions Server, an improper access control issue allows a View-only user to retrieve sensitive third-level nested fields, such as password list custom values, resulting in password disclosure. Affects versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier.

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie. This does not bypass the target account MFA verification step. This issue affects versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier.

An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.

Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.