The vulnerability originates from a missing authorization check in the PAM module of Devolutions Server. An attacker who is already authenticated and holds a PAM license, but lacks additional permissions, can make specially crafted requests to the PAM API endpoints to retrieve OTP secret keys and recovery codes. The flaw permits the exposure of authentication secrets that are intended to protect user accounts, effectively allowing an attacker to bypass two‑factor authentication and gain full control over the affected accounts. This is classified as a missing authorization weakness (CWE‑862).

Devolutions Server versions 2026.1.6.0 through 2026.1.11.0 and all releases 2025.3.16.0 and earlier are impacted. The vendor is Devolutions.

Because the flaw can be triggered with only a standard authenticated session and requires no special privileges beyond a PAM license, the likelihood of exploitation is high in environments where such licenses are used. Attackers would craft requests to the PAM API to obtain OTP secrets and recovery codes, which could then be used to compromise other systems or accounts. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the exposed critical credentials make the risk significant. The CVSS score is not provided, yet the potential impact on confidentiality and authentication integrity warrants high concern.