Critical Devolutions Server Flaw (CVE-2025-12485, CVSS 9.4) Allows User Impersonation via Pre-MFA Cookie Hijacking

The article reports that Devolutions Server has two vulnerabilities tracked as CVE-2025-12485 (CVSS 9.4) and CVE-2025-12808, both affecting multiple versions of the self-hosted product. According to Devolutions, CVE-2025-12485 stems from improper privilege management during pre-MFA cookie handling, allowing a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie, though it does not bypass the MFA verification step itself.

The advisory warns that such impersonation could enable unauthorized access to critical assets, audit log manipulation, or configuration tampering within privileged workflows. The second flaw, CVE-2025-12808 (CVSS 7.1), arises from improper access control in handling of nested fields, enabling a View-only user to retrieve sensitive third-level nested fields such as password lists or custom values, leading to potential password disclosure.

Remediation requires upgrading to Devolutions Server 2025.3.6.0 or higher or 2025.2.17.0 or higher, as there is no effective configuration workaround to fully mitigate the issues.