CVE-2026-109245 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within FreeRDP versions prior to 3.32.0 represents a critical failure in Transport Layer Security (TLS) certificate validation, specifically located in the freerdp_http_request function found in libfreerdp/utils/http.c. This flaw allows the application to successfully complete TLS handshakes with remote servers without performing any verification of the server's certificate chain. In standard secure communications, clients must validate that the presented X.509 certificates are signed by a trusted Certificate Authority and match the expected hostname to prevent man-in-the-middle attacks. By bypassing this essential check, FreeRDP effectively trusts any valid TLS connection regardless of its authenticity or origin, creating a severe security gap in how remote desktop sessions establish secure channels with backend services.
The operational impact of this vulnerability is particularly acute during Azure Active Directory authentication flows where FreeRDP interacts with Microsoft online services. Attackers positioned on the network path between the client and the target service can exploit this lack of validation to perform sophisticated man-in-the-middle attacks. Specifically, an attacker can impersonate login.microsoftonline.com by presenting a self-signed or improperly validated certificate that matches the expected hostname but lacks proper chain verification. This enables the interception of sensitive OAuth authorization codes as they are transmitted from the client to the authentication server. Furthermore, the attacker can substitute the OpenID discovery document served during this process with malicious content designed to redirect credentials or session tokens to an adversary-controlled endpoint rather than Microsoft's legitimate infrastructure.
This vulnerability aligns closely with CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information within the Common Weakness Enumeration framework. From a tactical perspective, it facilitates MITM attacks that fall under ATT&CK technique T1048 which encompasses Exfiltration Over Alternative Protocol as well as techniques related to credential interception such as T1557 Adversary-in-the-Middle for stealing OAuth tokens and credentials. The ability to capture authorization codes allows attackers to potentially hijack user sessions, access protected resources without further authentication, or escalate privileges within the Azure AD environment by exchanging stolen tokens for new ones that appear legitimate to downstream services.
Mitigation requires immediate upgrading of FreeRDP to version 3.32.0 or later where this certificate validation logic has been corrected to enforce strict chain verification and hostname matching during HTTP requests initiated via TLS. Organizations relying on FreeRDP for remote access should also implement network-level monitoring to detect anomalies in TLS handshake parameters that might indicate active exploitation attempts, such as connections using certificates from untrusted authorities despite the client's configuration expecting trusted ones. Additionally, enforcing Certificate Transparency logs and utilizing mutual TLS where applicable can provide additional layers of verification beyond standard PKI checks, ensuring that even if a software flaw exists, the network architecture provides compensating controls against impersonation attacks targeting Azure AD authentication endpoints.