Devolutions Server Flaw Allows Attackers to Impersonate Users via Pre-MFA Cookie

Devolutions Server has a critical flaw that lets low-privileged authenticated users impersonate other accounts by replaying pre-MFA cookies, identified as CVE-2025-12485 with a CVSS of 9.4 and affecting all versions up to 2025.3.5. The flaw arises from improper privilege management during pre-MFA cookie handling, and an attacker can intercept and replay a pre-MFA cookie from a legitimate user to impersonate their account, although it does not fully bypass MFA.

Patches have been released, and a second vulnerability, CVE-2025-12808 with a CVSS of 7.1, has also been disclosed, involving improper access control that allows view-only users to access sensitive third‑level nested fields. Organisations are advised to upgrade to version 2025.3.6.0 or higher, or, for older release branches, to 2025.2.17.0 or higher; the initial security advisory was published on 6 November 2025, detailing remediation paths for both issues.