CVE-2026-109245: FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when they use the Azure AD authentication flow that reaches login.microsoftonline.com through freerdp_http_request().
What must an attacker be able to do to exploit it?
An attacker must be positioned on the network path and able to impersonate login.microsoftonline.com during the Azure AD authentication flow. Exploitation also requires user interaction, and can enable capture of OAuth authorization codes and substitution of the OpenID discovery document.
What is the immediate remediation?
Upgrade FreeRDP to version 3.32.0 or later. The affected behavior is failure to verify the server certificate chain during the TLS handshake.