CVE-2026-105485: CWE-294 Authentication bypass by capture-replay in Devolutions Server

This vulnerability involves an authentication bypass in the OAuth device authorization flow of Devolutions Server. Specifically, an attacker can capture a device verification link used during the OAuth flow and replay it to gain unauthorized access to a user's account. The issue affects versions prior to 2026.3.8.0. No CVSS score is provided, and there is no indication of known exploits in the wild or vendor-provided patches.

Successful exploitation allows a remote attacker to take over a user's account by replaying a captured device verification link, effectively bypassing authentication controls. This compromises user account integrity and potentially exposes sensitive data or administrative capabilities within the affected Devolutions Server instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is indicated, users should monitor the vendor's communications for updates. Until a fix is available, avoid sharing device verification links and consider additional monitoring or temporary controls around OAuth device authorization flows.