This vulnerability (CWE-305) in Devolutions Server affects versions 2026.1.6.0 through 2026.1.16.0 and involves improper handling of the factor key state in the MFA management feature. Specifically, after a user reconfigures their MFA factors, an attacker with knowledge of the user's password can bypass the MFA requirement, effectively circumventing the additional authentication layer. The vulnerability is documented but lacks a CVSS score and no official remediation or patch information is provided in the available data.

An attacker who has obtained a user's password can bypass the multi-factor authentication mechanism after the user changes their MFA factors, potentially gaining unauthorized access to the user's account. This undermines the security benefits of MFA, increasing the risk of account compromise. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider additional compensating controls such as monitoring for suspicious login activity and restricting password knowledge exposure. Avoid relying solely on MFA reconfiguration events as a security boundary.