CVE-2025-12485 Overview
CVE-2025-12485 is an improper privilege management vulnerability [CWE-269] in Devolutions Server. The flaw exists in how the application handles pre-Multi-Factor Authentication (MFA) cookies during the login flow. A low-privileged authenticated attacker can replay another user's pre-MFA cookie to impersonate that account. The issue does not bypass the target account's MFA verification step, but it grants the attacker an authenticated session context tied to the impersonated user.
Critical Impact
Authenticated attackers can hijack other user identities by replaying intercepted pre-MFA cookies, compromising confidentiality, integrity, and availability of privileged secrets stored in Devolutions Server.
Affected Products
- Devolutions Server 2025.3.2.0 through 2025.3.5.0
- Devolutions Server 2025.2.15.0 and earlier
- Component: devolutions:devolutions_server
Discovery Timeline
- 2025-11-06 - CVE-2025-12485 published to the National Vulnerability Database (NVD)
- 2025-11-10 - Last updated in NVD database
- Vendor advisory - Devolutions Security Advisory DEVO-2025-0016
Technical Details for CVE-2025-12485
Vulnerability Analysis
Devolutions Server issues a pre-MFA session cookie after primary credential validation and before the second authentication factor is verified. The server fails to bind this cookie to the originating user identity in a tamper-resistant way. A low-privileged authenticated user who obtains another user's pre-MFA cookie can replay it against the server. The application accepts the replayed cookie and associates the session with the victim's account.
The vulnerability falls under improper privilege management [CWE-269]. Successful exploitation provides access to secrets, connections, and entries authorized for the impersonated identity within the centralized credential vault. Devolutions Server is widely used to manage shared privileged accounts, which amplifies the operational impact of session impersonation.
Root Cause
The root cause is insufficient privilege separation in pre-MFA cookie handling. The cookie does not carry an integrity-bound user binding that the server validates before honoring the session. Without that binding, a cookie minted for one principal can be replayed to act as that principal.
Attack Vector
An attacker must hold valid credentials for a low-privileged account on the same Devolutions Server instance. The attacker obtains a pre-MFA cookie issued to a target user, for example through shared browser environments, network observation in misconfigured deployments, log scraping, or social engineering. The attacker then submits the replayed cookie to the server and proceeds in the authenticated session of the victim. MFA on the target account still gates explicit MFA-protected actions, but the impersonated session itself is granted.
No verified public proof-of-concept code is available. Refer to the Devolutions Security Advisory DEVO-2025-0016 for vendor technical details.
Detection Methods for CVE-2025-12485
Indicators of Compromise
- Multiple authentication sessions for the same user originating from different IP addresses or user agents within a short window.
- Pre-MFA cookies appearing in requests from accounts that did not initiate the corresponding login.
- Unexpected access to vault entries by users who did not complete a normal interactive login sequence.
Detection Strategies
- Correlate Devolutions Server authentication logs with downstream entry-access logs to surface sessions that act under a different identity than the one that authenticated.
- Alert on reuse of the same pre-MFA session identifier across distinct source IPs or client fingerprints.
- Monitor for low-privileged accounts performing requests that resolve to higher-privileged user contexts.
Monitoring Recommendations
- Enable verbose authentication and session logging on Devolutions Server and forward events to a centralized SIEM for retention and correlation.
- Baseline normal login geography and device fingerprints per user, then alert on deviations tied to pre-MFA endpoints.
- Review audit trails of vault entry retrievals daily, focusing on accounts with elevated stored secrets.
How to Mitigate CVE-2025-12485
Immediate Actions Required
- Upgrade Devolutions Server to a fixed release as identified in DEVO-2025-0016.
- Invalidate all active sessions and force re-authentication for every user after upgrading.
- Rotate high-value secrets stored in the vault if impersonation activity is suspected in audit logs.
- Restrict network exposure of the Devolutions Server administrative interface to trusted segments.
Patch Information
Devolutions has published a security advisory and fixed builds. Administrators running Devolutions Server 2025.3.2.0 through 2025.3.5.0 or 2025.2.15.0 and earlier should apply the vendor-supplied update. See the Devolutions Security Advisory for the specific patched version and upgrade guidance.
Workarounds
- Limit account provisioning to reduce the population of low-privileged authenticated users who could initiate the attack.
- Enforce short session and cookie lifetimes for pre-MFA states where supported by the product configuration.
- Require source IP or device binding on session cookies through any available reverse proxy or web application firewall in front of Devolutions Server until the patch is applied.
# Configuration example: review and rotate Devolutions Server sessions after patching
# (Run from an administrative context with appropriate permissions)
# 1. Verify installed version
Get-ItemProperty -Path 'HKLM:\Software\Devolutions\Server' | Select-Object DisplayVersion
# 2. After upgrade, force re-authentication by recycling the application pool
Import-Module WebAdministration
Restart-WebAppPool -Name 'DevolutionsServerAppPool'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
