CVE-2026-66402
Received Received - Intake

TLS Certificate Validation Bypass in FreeRDP

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-66402
EUVD
EUVD-2026-51851

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has multiple weaknesses in TLS certificate validation. It incorrectly validates server certificates by truncating DNS SAN values at NUL bytes, accepting mismatched Common Names even with non-matching DNS SANs, and allowing IP-literal targets without proper IPAddress SAN comparison. This lets attackers bypass server identity verification using trusted or misissued certificates.

Detection Guidance

Detecting this vulnerability requires checking the FreeRDP version on your system. Run 'xfreerdp --version' or 'freerdp2 --version' to see if you are using a vulnerable version (<= 3.28.0). If the version is 3.28.0 or older, your system is affected.

Impact Analysis

An attacker could impersonate a legitimate server by presenting a specially crafted certificate. This could lead to man-in-the-middle attacks, allowing interception or manipulation of data transmitted to the server. Users might unknowingly connect to malicious servers, risking data theft or unauthorized access.

Compliance Impact

This vulnerability weakens TLS server authentication, potentially violating requirements for secure data transmission in GDPR and HIPAA. GDPR mandates strong encryption and integrity for personal data, while HIPAA requires secure communication for protected health information. Non-compliance risks legal penalties and data breaches.

Mitigation Strategies

Immediately update FreeRDP to version 3.29.0 or later. If updating is not possible, disable TLS certificate validation as a temporary workaround, but this is not recommended for security reasons.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart