Improper input validation in Devolutions Server's external authentication provider flow can be exploited by unauthenticated attackers to craft a login link that redirects users to an attacker‑controlled domain.

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and all releases 2025.3.20.0 and earlier are affected.

The flaw permits remote exploitation without authentication; an attacker can manually create the malicious login link using the vulnerable flow. The CVSS score is 5.0, indicating moderate severity, but the lack of authentication requirement keeps the risk significant. EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires no privileged access or special conditions beyond control of the login link, the risk remains high for any environment that relies on the external authentication provider.