CVE-2026-72746 in FreeRDP
Summary
by MITRE • 08/11/2026
FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical server-side authentication bypass in FreeRDP versions prior to 3.30.0, specifically affecting the RDSTLS handshake mechanism. This issue resides within the RdstlsSecurity functionality where the protocol implementation fails to properly validate the sequence and type of incoming Protocol Data Units during the secure transport layer negotiation process. The flaw manifests when a server is configured with RdstlsSecurity = TRUE, creating an environment where authentication controls become entirely ineffective due to improper state validation.
The technical root cause stems from the RDSTLS handshake dispatch mechanism which processes inbound PDUs based exclusively on the attacker-supplied pduType field without enforcing proper protocol state validation. This design flaw allows malicious actors to manipulate the communication flow by sending Capability PDUs instead of the required Authentication Request PDUs at the appropriate stage of the negotiation sequence. The rdpRdstls object initialization through calloc-zeroing creates a dangerous default condition where resultCode is initialized to 0, which corresponds to RDSTLS_RESULT_SUCCESS in the protocol implementation.
This authentication bypass occurs because the rdstls_process_capabilities() function returns success without ever setting the resultCode field to indicate failure conditions, effectively allowing unauthenticated connections to proceed as if they had successfully authenticated. The server responds with an AUTHRSP packet containing resultCode SUCCESS, thereby treating the session as fully authenticated without performing any password validation, redirection GUID verification, or auto-reconnect cookie evaluation. This fundamental breakdown in authentication logic creates a pathway for remote attackers to gain unauthorized access to systems protected by FreeRDP services.
The operational impact of this vulnerability is severe and far-reaching, as it completely undermines the security model of RDSTLS-protected FreeRDP servers. Attackers can exploit this weakness to establish sessions without proper credentials, potentially gaining access to sensitive corporate networks, internal resources, or administrative functions that rely on FreeRDP for remote access. The vulnerability affects multiple versions within the 3.x series, including 3.27.1, and impacts the master HEAD branch, indicating a widespread exposure across the FreeRDP codebase.
The flaw aligns with CWE-284 (Improper Access Control) and CWE-306 (Missing Authentication Check) categories, representing a classic case of insufficient input validation combined with improper error handling in security-critical code paths. From an ATT&CK perspective, this vulnerability maps to T1110 (Brute Force) and T1078 (Valid Accounts) techniques, as it allows attackers to bypass authentication entirely rather than attempting credential guessing or account exploitation. The vulnerability demonstrates a critical design flaw in protocol state management where the system trusts client-supplied data without proper validation, creating an attack surface that enables privilege escalation through session hijacking.
Organizations using FreeRDP servers configured with RdstlsSecurity = TRUE should immediately implement mitigations including upgrading to version 3.30.0 or later, disabling RDSTLS functionality until a patched version is deployed, or implementing network-level access controls to restrict client connections. Additionally, administrators should monitor authentication logs for suspicious activity patterns that might indicate exploitation attempts and consider implementing intrusion detection systems to identify potential exploitation of this vulnerability in their environments.