REDHAT-BUG-2514349: High severity FreeRDP freerdp vulnerability

Q: Who can exploit this issue?

A remote unauthenticated client can exploit it against a FreeRDP server using server-side RDSTLS authentication.

Q: What does an attacker need to send to bypass authentication checks?

The attacker must send an RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for an RDSTLS_TYPE_AUTHREQ PDU. This can leave the result code set to success and bypass RedirectionGuid, username, domain, and password checks.

Q: Which versions are affected and what version fixes the issue?

FreeRDP versions prior to 3.30.0 are affected. The issue is fixed in FreeRDP 3.30.0.

Published Aug 11, 2026

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.

Affected Software

1 affected component

FreeRDP freerdp<3.30.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.30.0

Event History

Aug 11, 2026

Data Sourced

via Red Hat·08:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote unauthenticated client can exploit it against a FreeRDP server using server-side RDSTLS authentication.

What does an attacker need to send to bypass authentication checks?

The attacker must send an RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for an RDSTLS_TYPE_AUTHREQ PDU. This can leave the result code set to success and bypass RedirectionGuid, username, domain, and password checks.

Which versions are affected and what version fixes the issue?

FreeRDP versions prior to 3.30.0 are affected. The issue is fixed in FreeRDP 3.30.0.

REDHAT-BUG-2514349: High severity FreeRDP freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to bypass authentication checks?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to bypass authentication checks?

Which versions are affected and what version fixes the issue?