Devolutions Server Two-Factor Authentication Bypass Vulnerability

A vulnerability allowing the bypass of two-factor authentication (2FA) has been identified in Devolutions Server versions through 2026.1.11. This issue arises from improper authentication in the 2FA feature, which enables a remote attacker with valid credentials to circumvent multifactor authentication and gain unauthorized access to a victim's account by reusing a partially authenticated session token.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including those of administrators, by bypassing multifactor authentication.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.12.0 or higher, or version 2025.3.18 or higher.