CVE-2026-73241 in FreeRDP
Summary
by MITRE • 08/11/2026
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability in FreeRDP affects the server-side implementation of the Remote Desktop Protocol within versions prior to 3.30.0, specifically within the RDSTLS component located in libfreerdp/core/rdstls.c. This security flaw represents a critical authentication bypass weakness that undermines the fundamental security mechanisms of the remote desktop service. The issue stems from improper state handling during the TLS authentication handshake process where the system accepts certain PDUs out of sequence, creating an exploitable window in the authentication flow.
The technical implementation flaw occurs when the rdstls_server_authenticate function is in a waiting state for RDSTLS_TYPE_AUTHREQ PDUs while simultaneously accepting attacker-controlled RDSTLS_TYPE_CAPABILITIES PDUs. This misordering allows the protocol stack to maintain the resultCode variable at RDSTLS_RESULT_SUCCESS even when no proper authentication has occurred, effectively enabling an unauthenticated remote attacker to proceed past crucial security checkpoints. The vulnerability creates a scenario where the RedirectionGuid, username, domain, and password validation checks are bypassed entirely, rendering the entire authentication framework ineffective.
From an operational impact perspective, this vulnerability enables remote attackers to gain unauthorized access to systems protected by FreeRDP server implementations without providing valid credentials. The attack requires minimal privileges and can be executed from anywhere on the network, making it particularly dangerous for environments where remote desktop services are exposed to untrusted networks. The bypass affects authentication mechanisms that should prevent unauthorized users from establishing legitimate connections to remote desktop sessions, potentially leading to full system compromise and lateral movement within network environments.
The security implications align with CWE-284, which addresses improper access control vulnerabilities in authentication systems. This weakness directly maps to the ATT&CK framework's privilege escalation and initial access tactics where adversaries can bypass authentication mechanisms to gain unauthorized system access. Organizations utilizing FreeRDP server implementations are particularly vulnerable if they have exposed remote desktop services or if their systems do not implement additional network-level security controls such as firewalls, VPNs, or network segmentation. The vulnerability demonstrates a critical failure in protocol state management and highlights the importance of proper sequence validation in cryptographic authentication flows.
Mitigation strategies should prioritize immediate deployment of FreeRDP version 3.30.0 or later, which addresses this specific authentication bypass issue through improved state handling and PDU sequence validation. Network administrators should also implement additional security layers including restrictive firewall rules limiting access to remote desktop ports, network segmentation to isolate remote desktop services, and monitoring systems to detect anomalous authentication patterns. Organizations should conduct comprehensive vulnerability assessments of all FreeRDP implementations within their infrastructure and consider implementing multi-factor authentication mechanisms as additional defense-in-depth controls. The fix in version 3.30.0 demonstrates the importance of proper state machine implementation in security-critical protocols where sequence validation prevents attackers from manipulating protocol flow to bypass authentication requirements.