A vulnerability in Devolutions Server releases up to version 2026.3.12.0 stores TOTP shared secrets in cleartext within the user account database. The stored values are exposed as an unencrypted copy of the security key when an administrator saves a user account. Because the attack exploits the mapping of TOTP keys to a database table, the weakness is classified as CWE‑312, which means attackers can read sensitive authentication data directly from the database.

The affected product is Devolutions Server. All releases version 2026.3.12.0 and earlier are impacted. No other vendors or products are listed as affected.

The EPSS score is not reported and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits at this time. However, an attacker who obtains read access to the database or a database backup can retrieve the TOTP shared secrets, potentially allowing the attacker to bypass two‑factor authentication and gain complete user account access. The likely attack vector is direct database read via DBA privileges or extraction from a backup, so the vulnerability is only exploitable by individuals who already possess such access permissions. The lack of a public exploit does not reduce the potential severity of the confidentiality compromise if the conditions are met.