TLS certificate identity validation bypass in FreeRDP (CVE-2026-66402)

FreeRDP performs custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity validation APIs, introducing three distinct weaknesses in server identity verification: DNS SAN values are truncated at embedded NUL bytes, a matching Common Name is accepted even when non-matching DNS SAN entries are present, and IP-literal targets are matched via DNS/CN logic rather than iPAddress SANs. Under a trusted, private, or misissued certificate chain, an attacker able to present a crafted certificate can bypass TLS server authentication. Affected versions: - <= 3.28.0 We recommend updating to: 3.29.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3 Details: https://vuln.today/cve/CVE-2026-66402