Improper input validation in the PAM AD discovery endpoints allows an authenticated user with the UserGroupsView permission to force the server to authenticate to an attacker‑controlled host, causing the server to expose PAM provider credentials as an NTLMv2 challenge-response. The flaw is a CWE-1284 weakness that violates authentication integrity by revealing credentials that should remain confidential.

Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 are impacted. Only accounts that possess the UserGroupsView permission can trigger the flaw.

The CVSS score of 2.7 indicates low severity, and the EPSS score is not available. The likely attack vector requires the attacker to be logged in with UserGroupsView permission and to send a crafted DomainName parameter that redirects server authentication to a malicious host. There are no publicly documented exploits, and the vulnerability is not listed in CISA KEV, but successful exploitation would result in the exposure of credentials that could be captured or replayed.