CVE-2026-67294
Received Received - Intake

Improper EKU Validation in FreeRDP TLS Authentication

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67294
EUVD
EUVD-2026-51842

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a flaw in its TLS authentication process. When verifying a server certificate, it checks the Extended Key Usage (EKU) purpose. If the server-purpose check fails, the code incorrectly falls back to client-purpose or any-purpose verification. This means a certificate trusted for client authentication only can be accepted as a valid server certificate if it matches the hostname, bypassing proper server certificate validation.

Impact Analysis

This vulnerability allows an attacker to impersonate an RDP server using a certificate that is only valid for client authentication. If exploited, it could lead to man-in-the-middle attacks, enabling the attacker to intercept or alter communications between the client and server. This poses a risk to data confidentiality and integrity during remote desktop sessions.

Compliance Impact

This vulnerability undermines secure authentication practices required by GDPR and HIPAA, which mandate strong encryption and proper certificate validation to protect sensitive data. Failure to validate server certificates correctly could result in non-compliance, as it exposes data to potential interception or tampering during transmission.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later to address the improper EKU validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart