Executive Summary

This vulnerability is caused by improper input validation in the PAM AD discovery endpoints of Devolutions Server versions 2026.2.4.0 through 2026.2.7.0.

An authenticated user who has the UserGroupsView permission can exploit this flaw by supplying a crafted DomainName parameter.

This allows the attacker to coerce server-side authentication to an attacker-controlled host, which results in exposing PAM provider credentials as an NTLMv2 challenge-response.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to the exposure of PAM provider credentials through an NTLMv2 challenge-response.

An attacker with UserGroupsView permission can redirect authentication attempts to a host they control, potentially allowing them to capture sensitive authentication data.

This could lead to unauthorized access or further attacks leveraging the exposed credentials.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes PAM provider credentials as an NTLMv2 challenge-response to an attacker-controlled host, which could lead to unauthorized access or credential compromise.

Such exposure of sensitive authentication credentials may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and user authentication information.

Organizations using affected versions of Devolutions Server should remediate by upgrading to version 2026.2.9.0 or higher to reduce the risk of non-compliance due to this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Devolutions Server to version 2026.2.9.0 or higher.

Useful 0 Not Useful 0