CVE-2026-72746
Received Received - Intake

Authentication Bypass in FreeRDP via RDSTLS Handshake

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72746
EUVD
EUVD-2026-56136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.30.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before 3.30.0 has a server-side authentication bypass in the RDSTLS handshake. When RdstlsSecurity is enabled, an unauthenticated attacker can send a Capabilities PDU instead of the required Authentication Request PDU. The server incorrectly processes this as valid due to default zeroed memory and improper PDU type handling, returning a success result and treating the session as authenticated without verifying credentials.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP server configurations and network traffic. Inspect FreeRDP server settings for RdstlsSecurity=TRUE. Monitor network traffic for unexpected Capabilities PDUs during authentication handshakes. Use tools like Wireshark to analyze TLS traffic for FreeRDP sessions.

Impact Analysis

An attacker could gain unauthorized access to FreeRDP servers configured with RdstlsSecurity enabled. This allows bypassing authentication to establish sessions without valid credentials, potentially leading to data exposure, unauthorized actions, or further network compromise. Systems using vulnerable FreeRDP versions (3.x series) are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable FreeRDP servers may fail compliance audits due to inadequate authentication controls, risking legal penalties and reputational damage.

Mitigation Strategies

Disable RDSTLS security by setting RdstlsSecurity=FALSE in FreeRDP server configurations. Implement additional authentication checks in the server's Logon callback. Monitor for unauthorized access attempts and update FreeRDP to the latest patched version once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart