Improper authentication in the two‑factor authentication feature of Devolutions Server allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account through reuse of a partially authenticated session token. The flaw is an authentication bypass (CWE‑1390) that leads to unauthorized account access and can potentially allow the attacker to use the compromised account to perform further actions within the affected system.

Devolutions Server, versions 2026.1.11 and earlier are affected by this vulnerability.

The CVSS score of 8.2 indicates high severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker must first authenticate with valid credentials and then reuse the session token to bypass 2FA. Once authenticated, the attacker can access all functions available to the victim account, potentially compromising data and operations.