The vulnerability in Devolutions Server 2026.3.7.0 and earlier allows an attacker to bypass authentication by replaying a captured OAuth device verification link. This flaw can enable an attacker to impersonate an authenticated victim and take over their user account, potentially granting full access to the victim’s data and administrative functions. The impacted weakness is an authentication bypass (CWE-294).

Devolutions Server versions 2026.3.7.0 and earlier are affected. The issue involves the server’s implementation of the OAuth device authorization flow.

Based on the description, the likely attack vector is remote exploitation via replay of a captured device verification link. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 6.8 indicates a moderate severity, confirming a non‑negligible risk. An attacker only needs to capture a device verification link used by an authenticated user and replay it from a remote location, so no privileged access to the server is required. Because this is a remote authentication bypass, the potential impact spans confidentiality, integrity, and availability for all affected accounts. Immediate action is strongly advised given the severity of account takeover and the lack of publicly documented countermeasures.