The flaw involves a weakness in the external OAuth authentication flow of Devolutions Server. When an authenticated user obtains a session code from an OAuth flow, that session code can be reused to authenticate as any other user, including administrators. The result is unauthorized impersonation, allowing the attacker to perform actions under a different, potentially higher‑privileged identity. This is a classic case of improper authentication as indicated by the associated weakness identifier.

Devolutions Server versions 2026.1.11 and any earlier releases are affected. The vulnerability applies across the Devolutions Server product and does not appear in later release branches beyond the stated threshold.

The CVSS score of 5.4 indicates a moderate risk level, while the EPSS score below 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning it has not been observed in public exploitation. The attack requires an authenticated session to capture a reusable OAuth session code; once the code is in hand, the path to impersonation is straightforward and does not demand special privileges beyond regular authentication.