This vulnerability (CWE-295) arises from improper validation of TLS certificates in the Devolutions Server connection handling within Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS platforms. An attacker positioned on the same network segment could exploit this flaw by presenting a forged TLS certificate, potentially intercepting and altering sensitive data transmitted between the client and server. The vulnerability is publicly disclosed but lacks a CVSS score and no official remediation or patch information is currently available.

An adjacent-network attacker could exploit this vulnerability to intercept and modify sensitive information transmitted by the affected Devolutions Password Manager clients. This compromises the confidentiality and integrity of the data exchanged with the Devolutions Server. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted or public networks for sensitive operations with the affected versions. Monitor official Devolutions communications for updates and apply patches promptly once released.