This vulnerability in Devolutions Server permits unauthorized password changes due to lack of verification of the previous password in the password change process. A crafted request can bypass authentication controls to reset user passwords. Affected versions include 2025.3.20.0 and all versions up to 2026.1.16.0. No official patch or remediation information has been provided by the vendor at this time.

An attacker exploiting this vulnerability can change any user's password without knowing the original password, potentially leading to unauthorized account access and privilege escalation within the affected Devolutions Server environment. This could compromise the confidentiality and integrity of user accounts managed by the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Devolutions Server management interfaces and monitor for suspicious password change requests. Avoid exposing the server to untrusted networks where possible.