An authenticated API in Devolutions Server allows users with user‑management privileges to retrieve other users’ one‑time password (OTP) keys, exposing the secrets that protect multi‑factor authentication. The vulnerability, classified as CWE‑201, compromises the confidentiality of MFA credentials and enables attackers who obtain such keys to perform account takeovers or bypass two‑factor protections. The attack does not directly grant code execution or denial of service, but it removes a critical layer of security.

The flaw affects Devolutions Server versions 2026.1.6 through 2026.1.11. Users of these releases should verify whether they are running an impacted build and assess the presence of user‑management role assignments.

The CVSS score of 6.5 indicates a moderate to high severity. Because exploitation requires legitimate, privileged user access, the EPSS score is below 1 %, suggesting a low probability of widespread, automated attacks. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, compromised OTP keys can lead to full account compromise, so the risk remains substantial for any system where malicious or compromised privileged users exist.