An authenticated user who has delegated permission to update users from the identity provider can trigger the synchronization API and obtain other users' MFA secrets. The bug causes the server to include sensitive MFA secret data in the API response, allowing the attacker to read and exfiltrate that data. This results in a confidentiality compromise of MFA mechanisms, potentially enabling attackers to bypass multi‑factor authentication and gain account access.

Devolutions Server 2026.3.13.0 and earlier. All installations of this product that have not been patched to a newer release are affected.

The vulnerability requires that the attacker be authenticated and possess delegated update permission; it is therefore exploitable by privileged insiders. No public exploitation data or KEV listing is currently available, and the EPSS score is not provided. While the exact CVSS severity cannot be quantified, the ability to leak MFA secrets poses a high risk of account compromise when the privilege set is misconfigured.