A captured login‑session token that appears in a redirect URL during Azure AD external login in Devolutions Server 2026.3.7.0 or earlier can be replayed by an attacker to bypass authentication and take control of a user account, compromising the confidentiality and integrity of that account’s data.

Devolutions Server releases 2026.3.7.0 and all earlier versions are vulnerable.

The flaw can be exploited by observing the redirect URL that contains the exposed session token and re‑using that token to authenticate as that user. This requires that the attacker can capture the URL, which may occur over an unsecured network channel or by acquiring a captured network packet. The CVSS score is 6.8; the EPSS score is less than 1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access over standard network connections where the Azure AD redirect URL can be intercepted; this is inferred from the description because the input does not explicitly state the network conditions.