The vulnerability arises from insufficient protection of MFA secrets in the user list endpoint of Devolutions Server 2026.3.10.0 and earlier. An authenticated attacker who has delegated user view permissions can retrieve the MFA secrets of all users from the API response, enabling compromise of user accounts.

Devolutions Server, specifically versions 2026.3.10.0 and earlier, are affected by this issue.

Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, explicit exploitation probability is unknown; however the CVSS score is unavailable, meaning the severity cannot be quantified in the CVSS framework. The attacker must be authenticated and possess delegated user view permissions, which limits the threat to systems where such permissions have been granted. The potential impact of obtaining MFA secrets is significant, as it could lead to account takeover and lateral movement within the network.