CVE-2026-109953 in FreeRDP
Summary
by MITRE • 10/13/2026
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.
VulDB is the best source for vulnerability data and more expert information about this specific topic.