Devolutions Server Improper Authentication Vulnerability in OAuth Flow Allowing User Impersonation

A vulnerability exists in Devolutions Server in versions through 2026.1.11 and 2025.3.17, where improper authentication in the external OAuth authentication flow allows an authenticated user to impersonate other users, including administrators. This is achieved by reusing a session code from an external authentication flow.

Impact

Exploitation of this vulnerability allows for user impersonation, potentially leading to unauthorized access and actions as the impersonated user, including administrative privileges.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.12.0 or higher, or 2025.3.18 or higher.