CVE-2026-73241: FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP (libfreerdp/core/rdstls.c RDSTLS server authentication bypass)to a version that resolves this vulnerability.Fixed in 3.30.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73241?
CVE-2026-73241 has a risk score of 84, indicating a high severity vulnerability.
How do I fix CVE-2026-73241?
To mitigate CVE-2026-73241, update FreeRDP to version 3.30.0 or later.
What impact does CVE-2026-73241 have on FreeRDP?
CVE-2026-73241 allows an attacker to bypass server authentication by accepting a credential-less Capabilities PDU.
Which version of FreeRDP is vulnerable to CVE-2026-73241?
FreeRDP versions prior to 3.30.0 are vulnerable to CVE-2026-73241.
What is the main cause of CVE-2026-73241?
The vulnerability arises from the acceptance of an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU during the authentication step.