Improper privilege management during pre-MFA cookie handling in Devolutions Server 2025.3.5.0 and earlier allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.