This vulnerability arises from improper validation of the DomainName parameter in the PAM AD discovery endpoints of Devolutions Server 2026.2.4.0 through 2026.2.7.0. An authenticated user with UserGroupsView permission can exploit this flaw to redirect server-side authentication attempts to an attacker-controlled host, thereby exposing PAM provider credentials as an NTLMv2 challenge-response. The vulnerability is tracked as CWE-1284. No CVSS score or vendor advisory detailing patch availability or mitigation is currently provided.

The vulnerability allows an authenticated user with limited permissions (UserGroupsView) to coerce the server into authenticating to an attacker-controlled host, potentially exposing sensitive PAM provider credentials via NTLMv2 challenge-response. This could lead to credential exposure and subsequent unauthorized access if the attacker can leverage the captured authentication data. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict UserGroupsView permissions to trusted users only to reduce risk exposure. Monitor vendor communications for updates on patches or official mitigations.