Unrated severityNVD Advisory· Published Nov 6, 2025· Updated Nov 7, 2025
CVE-2025-12485
CVE-2025-12485
Description
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.
This issue affects the following versions :
* Devolutions Server 2025.3.2.0 through 2025.3.5.0 *
Devolutions Server 2025.2.15.0 and earlier
Affected products
2- Devolutions/Serverv5Range: 2025.3.2.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.