Devolutions Server Improper Privilege Management Vulnerability Allowing Account Impersonation

A vulnerability exists in Devolutions Server in versions through 2025.3.5.0, where improper privilege management during pre-MFA cookie handling allows low-privileged authenticated users to impersonate other accounts by replaying pre-MFA cookies. However, this does not bypass the MFA verification step for the target account.

Impact

Exploitation of this vulnerability allows for account impersonation, where a low-privileged user can act as another user, although the target's MFA verification is still required.

Remediation

Users are advised to upgrade to Devolutions Server version 2025.3.6.0 or higher.