An improper authorization vulnerability in Devolutions Server allows authenticated low-privileged users to disclose sensitive private keys via direct object references.

This vulnerability involves authorization bypass through a user-controlled key, specifically affecting the PAM SSH key and certificate retrieval endpoints. The attacker level requires an authenticated low-privileged user.

A successful exploit allows unauthorized access to sensitive credential information, specifically private SSH keys and certificates stored within the PAM system. This can lead to lateral movement, unauthorized infrastructure access, and complete compromise of connected systems. The high CVSS score of 7.5 reflects the severe confidentiality impact associated with credential exposure.

Immediate Action: Update Devolutions Server to version 2026.1.23, 2026.2.12, or later to resolve the authorization bypass.

Proactive Monitoring: Monitor access logs for anomalous direct object reference patterns or unusual credential retrieval requests from low-privileged accounts.

Compensating Controls: Implement strict role-based access controls and review PAM credential permissions to limit exposure until updates are applied.

Public Exploit Available: No

Given the high severity rating and potential for sensitive credential exposure, organizations utilizing Devolutions Server must prioritize applying the latest vendor patches. Immediate remediation is critical to prevent unauthorized retrieval of privileged SSH keys and maintain overall infrastructure security.