CVE-2026-109245 Overview
CVE-2026-109245 is an improper certificate validation vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP versions 3.0.0 through 3.31.x and resides in the freerdp_http_request() function in libfreerdp/utils/http.c. The function completes TLS handshakes without verifying the server certificate chain. An on-path attacker can impersonate login.microsoftonline.com during the Azure Active Directory (Azure AD) authentication flow, capture OAuth authorization codes, and substitute the OpenID discovery document. The vulnerability is tracked under [CWE-295: Improper Certificate Validation].
Critical Impact
On-path attackers can intercept Azure AD OAuth authorization codes and manipulate OpenID discovery responses, compromising confidentiality and integrity of RDP authentication sessions.
Affected Products
- FreeRDP 3.0.0 through 3.31.x (fixed in 3.32.0)
- Applications and distributions bundling vulnerable FreeRDP 3.x libraries
- RDP clients relying on libfreerdp for Azure AD authentication flows
Discovery Timeline
- 2026-10-12 - CVE-2026-109245 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
- 2026-10-16 - EPSS score published at 0.187%
Technical Details for CVE-2026-109245
Vulnerability Analysis
The vulnerability stems from freerdp_http_request() in libfreerdp/utils/http.c performing TLS handshakes without validating the presented server certificate chain. FreeRDP uses this function when fetching the OpenID discovery document and completing OAuth exchanges with login.microsoftonline.com during Azure AD authentication. Because the TLS layer accepts any certificate, an on-path attacker between the FreeRDP client and Microsoft's identity endpoints can transparently terminate the TLS session.
After interception, the attacker can serve a crafted OpenID discovery document that redirects authentication endpoints to attacker-controlled hosts. The attacker can also capture OAuth authorization codes returned by the authorization server. These codes can then be redeemed for access tokens, allowing the attacker to assume the user's Azure AD identity for subsequent RDP connections.
Root Cause
The root cause is a missing certificate chain verification step in the HTTP client path used for Azure AD discovery and OAuth. Standard TLS libraries require explicit configuration to validate peer certificates against a trusted certificate authority (CA) store. In the affected code, this verification is not enforced, so cryptographic authentication of the server endpoint is absent.
Attack Vector
Exploitation requires network adjacency sufficient to intercept traffic between the FreeRDP client and login.microsoftonline.com. Suitable positions include compromised Wi-Fi networks, malicious proxies, rogue DNS resolvers, and BGP hijacks. User interaction is required because the victim must initiate an Azure AD authentication flow through FreeRDP. The attacker needs no prior credentials.
The vulnerability manifests in freerdp_http_request() where TLS peer verification is not enforced. See the GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109245
Indicators of Compromise
- TLS connections from FreeRDP clients to hosts resolving as login.microsoftonline.com but presenting certificates not chained to a Microsoft-trusted CA
- Unexpected DNS responses mapping Microsoft identity hostnames to non-Microsoft IP ranges
- OpenID discovery documents returning authorization or token endpoints on non-Microsoft domains
- FreeRDP binaries with reported version strings between 3.0.0 and 3.31.x in enterprise software inventories
Detection Strategies
- Inventory FreeRDP installations across endpoints and flag any version earlier than 3.32.0
- Inspect outbound TLS metadata for Microsoft identity hostnames and alert when server certificates are not issued by Microsoft-operated CAs
- Correlate FreeRDP process launches with subsequent HTTPS requests to identity endpoints and verify destination autonomous system numbers (ASNs)
Monitoring Recommendations
- Log and review FreeRDP client telemetry including process execution, command-line arguments, and destination hosts
- Monitor Azure AD sign-in logs for anomalous OAuth authorization code redemptions from unexpected IP addresses or user agents
- Alert on DNS queries for login.microsoftonline.com from endpoints resolving to non-Microsoft IP space
How to Mitigate CVE-2026-109245
Immediate Actions Required
- Upgrade all FreeRDP 3.x installations to version 3.32.0 or later
- Audit downstream distributions and applications that bundle libfreerdp and apply vendor updates as they become available
- Review Azure AD sign-in logs for suspicious OAuth authorization code redemptions originating from untrusted networks
- Revoke and rotate any Azure AD refresh tokens associated with sessions initiated from vulnerable FreeRDP clients on untrusted networks
Patch Information
The FreeRDP project fixed the issue in version 3.32.0 by enforcing server certificate chain verification in freerdp_http_request(). Refer to the GitHub Security Advisory GHSA-h44v-39x6-9xvg for upstream patch commits and distribution-specific guidance.
Workarounds
- Restrict FreeRDP usage to trusted networks until clients are upgraded to 3.32.0 or later
- Require VPN or Zero Trust Network Access tunnels for RDP sessions that traverse untrusted networks
- Disable Azure AD authentication flows in FreeRDP where feasible and rely on alternative authentication mechanisms until patched
- Enforce DNS over HTTPS (DoH) or DNS over TLS (DoT) on endpoints to reduce the risk of DNS redirection enabling on-path interception
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
