Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73241FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)

High 8.3

In plain English

A high-severity improper authentication in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-12.el10_2.10ALSA-2026:61378
AlmaLinux:10freerdp-devel2:3.10.3-12.el10_2.10ALSA-2026:61378
AlmaLinux:10freerdp-libs2:3.10.3-12.el10_2.10ALSA-2026:61378
AlmaLinux:10freerdp-server2:3.10.3-12.el10_2.10ALSA-2026:61378
AlmaLinux:10libwinpr2:3.10.3-12.el10_2.10ALSA-2026:61378
AlmaLinux:10libwinpr-devel2:3.10.3-12.el10_2.10ALSA-2026:61378
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-73241
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-73241
Debian:14freerdp33.30.0+dfsg-1DEBIAN-CVE-2026-73241
Rocky Linux:10freerdp2:3.10.3-12.el10_2.10RLSA-2026:61378
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-73241
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-73241
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-73241

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.30.0

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References