Improper authentication in the OAuth login flow of Devolutions Server allows a remote attacker who already possesses valid user credentials to send a crafted request that skips the required multi‑factor checkpoint. This flaw enables the attacker to assume the same user session normally protected by two‑factor authentication, thereby granting unauthorized access to all resources that the legitimate account can reach. The core weakness is an authentication bypass as identified by CWE‑1390.

Versions of Devolutions Server up to and including 2026.1.11 are reported to have the flaw. No confirmation exists in the CVE data regarding the status of later releases; administrators should confirm that they are not running a vulnerable version.

The vulnerability carries a high CVSS score of 8.2, indicating significant potential damage, while an EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in the CISA KEV catalog, and exploitation requires the attacker to already hold valid credentials for a target account. Assessment of threat should consider that the attack vector involves forging an HTTP request to the OAuth endpoint from an external network; once the bypass is achieved, the attacker gains full authorization rights of the compromised account.