This vulnerability (CWE-601) in Devolutions Server involves improper input validation in the external authentication provider flow, enabling unauthenticated attackers to craft login URLs that redirect victims to arbitrary external domains. Affected versions include 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability is classified as an open redirect, which can facilitate phishing attacks by misleading users about the destination of links. There is no CVSS score assigned, no vendor advisory or patch information available, and no known active exploitation.

An attacker can exploit this vulnerability to redirect users to malicious websites, potentially facilitating phishing or other social engineering attacks. The vulnerability does not directly allow system compromise but can be used as part of broader attack chains targeting user trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with login links received from untrusted sources and verify URLs before clicking. Monitoring for updates from Devolutions regarding patches or mitigations is recommended.