The flaw is an improper certificate validation in the Devolutions Server connection handling of Devolutions Password Manager. Because the application does not correctly verify TLS certificates, an attacker who can inject traffic on the same local network can present a forged certificate and intercept or alter data transmitted between the client and the server.

Devolutions Password Manager (versions 2026.2.1.0 and earlier) on Android, iOS, and macOS are affected. The vulnerability is limited to those products and those operating systems; no other Devolutions products are mentioned as impacted.

The CVSS score of 7.4 indicates a high severity vulnerability. The EPSS score of less than 1 percent suggests that the likelihood of exploitation is currently low, and the bug is not listed in the CISA KEV catalog. The attack vector is inferred to be an adjacent‑network attacker able to inject traffic. If the attacker can influence the network path, they can deploy a forged certificate and perform a man‑in‑the‑middle attack, potentially gaining access to passwords and sensitive data being transmitted.