Devolutions Server Missing Authorization Vulnerability in PAM Module Allowing OTP Secret Key and Recovery Code Access

A vulnerability exists in the PAM module of Devolutions Server, specifically in versions 2026.1.6.0 through 2026.1.11.0 and Devolutions Server 2025.3.16.0 and earlier. This vulnerability arises from missing authorization, which allows an authenticated user with a PAM license but without additional permissions to access OTP secret keys and recovery codes. Exploitation can be achieved by sending crafted requests to PAM API endpoints.

Impact

Exploitation of this vulnerability allows unauthorized access to OTP secret keys and recovery codes, which could be used to bypass multi-factor authentication or gain unauthorized access to accounts.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.12.0 or higher, or version 2025.3.18 or higher.