Server EUVD-2026-17919

Devolutions Server 2026.1.11 and earlier with OAuth login enabled. Attacker requires valid user credentials. Multi-factor authentication (MFA) must be configured. Remote network access. No user interaction required.

While CVSS score is not provided, the vulnerability carries significant real-world risk. The attack requires valid user credentials (PR:L per description), but the impact-complete bypass of MFA-is critical for environments where MFA is the second layer of defense. The authentication bypass class (CWE-1390) is a fundamental control circumvention, indicating this is not a marginal security gap but a core authentication logic flaw. Absence of EPSS and KEV confirmation data suggests this may be recently disclosed or under embargo; however, the specificity of the vulnerability (OAuth MFA bypass) and vendor advisory availability indicate this is a substantive, reproducible issue rather than a low-probability theoretical flaw. Organizations running Devolutions Server in production should treat this as a high-priority vulnerability due to the severity of MFA bypass, even absent CVSS quantification.

An attacker with compromised or valid user credentials (e.g., via phishing or credential stuffing) initiates an OAuth login to Devolutions Server. Instead of completing the standard multi-factor authentication prompt, the attacker crafts a modified login request that exploits improper validation in the OAuth flow, causing the server to skip or incorrectly validate the MFA check. The attacker gains full access to the target user account without providing a valid second factor, allowing them to retrieve stored secrets, credentials, and sensitive data from the Devolutions Server vault.