CVE-2026-109245: FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

Q: Which deployments are exposed to this issue?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when they use the Azure AD authentication flow that reaches login.microsoftonline.com through freerdp_http_request().

Q: What must an attacker be able to do to exploit it?

An attacker must be positioned on the network path and able to impersonate login.microsoftonline.com during the Azure AD authentication flow. Exploitation also requires user interaction, and can enable capture of OAuth authorization codes and substitution of the OpenID discovery document.

Q: What is the immediate remediation?

Upgrade FreeRDP to version 3.32.0 or later. The affected behavior is failure to verify the server certificate chain during the TLS handshake.

Published Oct 12, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when they use the Azure AD authentication flow that reaches login.microsoftonline.com through freerdp_http_request().

What must an attacker be able to do to exploit it?

An attacker must be positioned on the network path and able to impersonate login.microsoftonline.com during the Azure AD authentication flow. Exploitation also requires user interaction, and can enable capture of OAuth authorization codes and substitution of the OpenID discovery document.

What is the immediate remediation?

Upgrade FreeRDP to version 3.32.0 or later. The affected behavior is failure to verify the server certificate chain during the TLS handshake.

CVE-2026-109245: FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What is the immediate remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What is the immediate remediation?