Devolutions Server Multi-Factor Authentication Bypass Vulnerability

A vulnerability in the multi-factor authentication management feature of Devolutions Server has been identified, allowing an attacker with knowledge of a user's password to bypass multi-factor authentication. This issue arises after a user reconfigures their authentication factors. The vulnerability affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0.

Impact

Exploitation of this vulnerability allows for unauthorized bypass of multi-factor authentication, potentially leading to unauthorized access to user accounts.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher.