Devolutions Server Improper Authorization Vulnerability in Active Directory Browsing Feature Allowing Authentication Material Relay

A vulnerability exists in the Active Directory browsing feature of Devolutions Server, specifically in versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. This vulnerability allows a low-privileged authenticated user to improperly obtain authentication material related to a stored Privileged Access Management (PAM) provider service account. The issue arises from an authorization flaw that enables the relay of authentication data to an attacker-controlled server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to authentication materials, potentially allowing for further exploitation of PAM provider service accounts.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher, or 2025.3.22.0 or higher.