QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-12485

Back to search

CVE-2025-12485

Published: Nov 6, 2025

Modified: Nov 7, 2025

PUBLISHED

Description

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier

VendorProductVersions

Devolutions

Server

affected
2025.3.2.0 - <= 2025.3.5.0
affected
0 - <= 2025.2.15.0

Weaknesses (CWE)

CWE-269

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now