The vulnerability arises from insufficient protection of MFA secrets in the user list endpoint of Devolutions Server 2026.3.10.0 and earlier. An authenticated attacker who has delegated user view permissions can retrieve the MFA secrets of all users from the API response, enabling compromise of user accounts.

Devolutions Server, specifically versions 2026.3.10.0 and earlier, are affected by this issue.

Because the EPSS score (<1%) indicates low exploitation probability and the vulnerability is not listed in CISA’s KEV catalog, explicit exploitation probability is considered low; the CVSS score of 4.3 provides a quantitative measure of the vulnerability's severity. The attacker must be authenticated and possess delegated user view permissions, which limits the threat to systems where such permissions have been granted. The potential impact of obtaining MFA secrets is significant, as it could lead to account takeover and lateral movement within the network.