All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-73241
HIGHpublished 2026-08-11 20:18 UTC · 1 day ago
8.3
CVSS / 10
// description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.
// weaknesses (CWE)
- CWE-287