The vulnerability is an improper authorization flaw in the Active Directory browsing feature of Devolutions Server. A low-privileged authenticated user can perform an authentication relay to an attacker-controlled server and retrieve authentication material tied to a stored PAM provider service account. This allows the attacker to acquire privileged credentials and potentially use them to authenticate to other systems, facilitating privilege escalation or lateral movement. The weakness is classified as CWE-918.

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier of the same product are affected by this flaw.

The vulnerability requires an authenticated session with low privileges on the Devolutions Server and enables the attacker to relay authentication to an external server, exposing credential material. The CVSS score of 7.1 indicates a medium-to-high level of risk. No EPSS score is available and the CVE is not listed in the CISA KEV catalog, however an attacker could exploit it by configuring a malicious server to capture the relayed credentials. Because the flaw permits credential theft, the potential impact is high, particularly in environments where stored PAM provider accounts are used for privileged access.