CVE-2025-8353

Description

UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing.

PUBLISHED Reserved 2025-07-30 | Published 2025-07-30 | Updated 2025-07-30 | Assigner DEVOLUTIONS

Problem types

CWE-446: UI Discrepancy for Security Feature

Product status

References

devolutions.net/security/advisories/DEVO-2025-0013/

cve.org (CVE-2025-8353)

nvd.nist.gov (CVE-2025-8353)

Download JSON