A flaw in Devolutions Server allows an authenticated user who can trigger the email configuration test to cause the system to transmit an stored SMTP password in plaintext. The attacker controls the SMTP host name sent to the test, which results in the password being included in the outgoing email test request. This can lead to the disclosure of credentials used to send email alerts, compromising the confidentiality of the system’s notification infrastructure.

Devolutions Server versions 2026.3.13.0 and earlier are impacted. All installations that use the test action to verify SMTP settings are vulnerable until patched to a newer release.

The vulnerability is exploitable only by users with valid accounts that have permission to initiate the test action; it does not require privileged system or external access. The exploit path is simple: an attacker changes the SMTP host field to a host they control, triggers the test, and captures the cleartext password in transit. No publicly available exploit is documented, and the EPSS score is not provided, but the potential for credential theft suggests a significant impact if the attacker can observe the network traffic. The vulnerability is not listed in CISA KEV.