VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 6, 2025· Updated Nov 7, 2025

CVE-2025-12485

CVE-2025-12485

Description

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.

This issue affects the following versions :

* Devolutions Server 2025.3.2.0 through 2025.3.5.0 *

Devolutions Server 2025.2.15.0 and earlier

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1
  • Devolutions/Serverv5
    Range: 2025.3.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.