CVE-2025-12485

⚡ A low-privileged user can impersonate another account with just a sneaky cookie replay! This flaw in Devolutions Server's handling of pre-MFA cookies is both shocking and dangerous. 🔥 Think of it like a party where someone sneaks in a fake invitation. While they still need to go through security (MFA), they could easily pretend to be someone else who’s already inside — causing chaos without breaking any rules! If exploited, this vulnerability allows an attacker to impersonate other users within Devolutions Server, potentially gaining unauthorized access to sensitive information and resources. While they won’t bypass the MFA step, the impersonation could lead to trust issues and data leaks, which can be absolutely devastating for your organization!

If exploited, this vulnerability allows an attacker to impersonate other users within Devolutions Server, potentially gaining unauthorized access to sensitive information and resources. While they won’t bypass the MFA step, the impersonation could lead to trust issues and data leaks, which can be absolutely devastating for your organization! To protect against this vulnerability, immediately update Devolutions Server to version 2025.3.6.0 or later. Additionally, review your cookie management practices and consider implementing stricter privilege checks to prevent similar issues in the future. You've got this! Stay vigilant, patch up, and secure your server to maintain your hero status! 🛡️