The flaw is an improper host validation in the social login autofill feature of Devolutions Remote Desktop Manager version 2026.2.8. When a forged or lookalike domain is presented as a social login provider, the application accepts the host and automatically extracts stored credentials, exposing the user’s social login passwords. This constitutes a breach of confidentiality, allowing an attacker to gain unauthorized access credentials without executing code or disrupting services.

Devolutions Remote Desktop Manager, specifically the 2026.2.8 release.

The vulnerability has a CVSS score of 5.5, indicating moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term. It is currently not listed in the CISA KEV catalog. The likely attack vector revolves around a remote attacker delivering a crafted web endpoint that mimics a legitimate social login provider; when a user’s Remote Desktop Manager client encounters this endpoint during autofill, it accepts the host and leaks stored credentials. Exploitation appears to require that the user interacts with the redirected provider and that the client’s host validation logic is inadequate. Existing mitigations are not provided in the advisory, emphasizing the need for a patch or configuration change.