The vulnerability is an authentication bypass that allows an unauthenticated user to forge a JSON Web Token and authenticate as any arbitrary Entra ID user in Devolutions Server. This creates a high‑risk privilege escalation where the attacker can gain full access to the system with the permissions of that chosen user. The weakness is classified as authentication failure (CWE‑287).

Devolutions Server version 2025.3.15.0 and all earlier releases are affected. No other products or versions are listed as vulnerable.

The CVSS score is 9.8, indicating critical severity. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the vulnerability can be exploited by sending a forged JWT to any exposed authentication endpoint, enabling an attacker to log in as a chosen Entra ID user without credentials.