Vulnerability Database

309,364

Total vulnerabilities in the database

CVE-2025-12485

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.

This issue affects the following versions :

  • Devolutions Server 2025.3.2.0 through 2025.3.5.0

Devolutions Server 2025.2.15.0 and earlier

  • Published: Nov 6, 2025
  • Updated: Nov 8, 2025
  • CVE: CVE-2025-12485
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWEs:

Software From Fixed in
devolutions / devolutions_server - 2025.2.17.0
devolutions / devolutions_server 2025.3.2.0 2025.3.6.0