Certificate purpose bypass in FreeRDP server TLS authentication (CVE-2026-67294)

FreeRDP's client-side TLS certificate verification improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during server authentication. In `x509_utils_verify()`, if server-purpose verification fails, the code falls back to client-purpose and any-purpose checks, allowing a clientAuth-only certificate from a trusted CA with a matching hostname to be accepted as an RDP server certificate. In environments relying on EKU separation between client and server certificates, a certificate that standard server-purpose verification rejects may be accepted by FreeRDP. Affected versions: - <= 3.28.0 We recommend updating to: 3.29.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-89c6-jjrw-96h4 Details: https://vuln.today/cve/CVE-2026-67294