CVE-2026-72746

Описание

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available.

A flaw was found in FreeRDP. An unauthenticated remote attacker could bypass the server-side authentication in the RDSTLS (Remote Desktop Services Transport Layer Security) handshake. By sending a Capabilities PDU instead of the expected Authentication Request PDU, the server incorrectly processes the request, leading to a successful authentication without validating any credentials. This allows the attacker to gain unauthorized access to a session.