Security researchers have disclosed a high-severity vulnerability in Devolutions Server, a popular Privileged Access Management (PAM) solution, that allows an authenticated attacker to impersonate other users. The flaw, tracked as CVE-2025-12485 with a CVSS score of 8.8, creates a potent risk for unauthorized account takeovers and lateral movement within a network.
The vulnerability stems from improper privilege management during the authentication process, specifically in how Devolutions Server handles the session cookie issued before a user completes multi-factor authentication (MFA). A low-privileged attacker who has already authenticated to the server can capture this “pre-MFA” session cookie. By replaying that cookie, the attacker can effectively switch their identity and log in as another user, such as a high-privilege administrator.
While the attack does not bypass the victim’s MFA requirement, it critically allows the attacker to be the victim up to that point. The attacker, impersonating the privileged user, would receive the MFA prompt. If the attacker is also able to trick the victim into approving the MFA push notification (a common “MFA fatigue” attack) or otherwise bypass the second factor, they would gain full access to the victim’s account. The flaw effectively breaks the identity-binding of the authentication workflow, allowing an attacker to “reach the MFA stage while impersonating another user.”
A second vulnerability (CVE-2025-12808, CVSS 7.1) was also discovered. This flaw involved improper access controls that allowed low-privilege, “read-only” accounts to view sensitive, hidden password fields and custom values. This breaks the principle of least privilege and role-based access controls (RBAC) within the PAM solution.
Devolutions has released patches to address both vulnerabilities, urging all customers to upgrade immediately to Devolutions Server version 2025.3.6.0 or 2025.2.17.0 and later to mitigate the risk. The company published its security advisory on November 6, 2025, providing details on the vulnerabilities and remediation guidance.
Sources: CyberPress, GBHackers
—
By the ID Tech Editorial Team
