Devolutions Server CVE-2026-9245

The vulnerability is triggered when a victim follows a crafted login link that includes a manipulated redirect parameter in the Devolutions Server external authentication provider flow - meaning the external authentication feature (OAuth/OIDC/SAML federation) must be configured and in use. Exploitation is limited by two concrete prerequisites: first, the victim must click the attacker-supplied link (UI:R), which requires successful social engineering; second, the attack complexity is rated high (AC:H), meaning the attacker must precisely understand the login flow URL structure to craft a valid malicious link. Deployments of Devolutions Server that do not use external authentication providers and instead rely solely on local authentication are not affected by this specific flaw. There is no privilege requirement for the attacker - the link is exploitable before the victim authenticates.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) yields a 5.0 base score reflecting network reachability and lack of required privileges, offset by high attack complexity and mandatory user interaction. The I:L and A:L components in the vendor-supplied vector appear inflated for a pure open-redirect class flaw - open redirects classically carry no direct integrity or availability impact; this discrepancy should be verified against the vendor advisory at DEVO-2026-0013. EPSS at 0.05% (16th percentile) confirms very low current exploitation probability. SSVC signals reinforce this: exploitation status is none, the attack is not automatable (requires social engineering to deliver the crafted link to a specific victim), and technical impact is only partial. Despite the modest raw scores, the deployment context materially elevates risk: Devolutions Server manages privileged credentials and remote access sessions, so a successful phishing redirect targeting an administrator could yield access to high-value infrastructure far beyond the immediate low-impact CVSS metrics suggest. No KEV listing and no POC code have been identified.

An attacker targeting a Devolutions Server administrator crafts a login URL that includes a tampered redirect parameter pointing to a credential-harvesting site mimicking the organization's internal portal. The link is delivered via a spearphishing email referencing a plausible session expiry notice. The victim authenticates successfully against the legitimate Devolutions Server, which then issues an HTTP redirect to the attacker's domain, where the victim unknowingly submits credentials or continues a session handshake that the attacker captures. No public exploit code exists at time of analysis, but the attack technique is well-understood and requires no specialized tooling.