Skip to main content

FreeRDP EUVDEUVD-2026-56934

| CVE-2026-73241 HIGH
Improper Authentication (CWE-287)
2026-08-11 security-advisories@github.com
Authentication Bypass Red Hat Suse
8.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable with no credentials required; high confidentiality impact from full auth bypass; low integrity impact; no availability impact; scope unchanged as exploitation is bounded to the targeted server.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 11, 2026 - 21:18 EUVD
Source Code Evidence Fetched
Aug 11, 2026 - 21:00 vuln.today
Analysis Generated
Aug 11, 2026 - 21:00 vuln.today
CVE Published
Aug 11, 2026 - 20:18 cve.org
HIGH 8.3

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.

AnalysisAI

Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Connect to FreeRDP server RDP port
Delivery
Establish TLS-protected RDSTLS channel
Exploit
Progress handshake to authentication phase
Install
Send RDSTLS_TYPE_CAPABILITIES PDU instead of expected RDSTLS_TYPE_AUTHREQ
C2
Server accepts PDU with no state check, resultCode remains RDSTLS_RESULT_SUCCESS
Execute
Authentication function returns success without credential verification
Impact
Obtain unauthorized RDP session bypassing all identity checks
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running FreeRDP in server mode - not client mode, which represents the majority of FreeRDP deployments - with the RDSTLS authentication path active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N) accurately characterizes a high-severity, network-exploitable authentication bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker connects to a FreeRDP RDP server on the standard RDP port and initiates the RDSTLS handshake. At the point where the server's rdstls_server_authenticate is waiting for an RDSTLS_TYPE_AUTHREQ PDU containing credentials, the attacker instead sends an RDSTLS_TYPE_CAPABILITIES PDU; lacking state-machine validation, the server processes it without error and returns with resultCode still at RDSTLS_RESULT_SUCCESS, granting the attacker an authenticated session context without any credential verification. …
Remediation The primary remediation is upgrading to FreeRDP 3.30.0 or later, confirmed via the official release at https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0 and GitHub Security Advisory GHSA-rqgv-grx4-xm6x. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all FreeRDP deployments in your environment and restrict RDP network access to trusted networks; immediately review RDP connection logs for unauthorized access attempts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-56934 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy