CVE-2026-73241: FreeRDP Auth Bypass Vulnerability

CVE-2026-73241 Overview

CVE-2026-73241 is an authentication bypass vulnerability in FreeRDP, an open-source implementation of the Microsoft Remote Desktop Protocol (RDP). The flaw resides in the server-side RDSTLS handler in libfreerdp/core/rdstls.c. FreeRDP versions prior to 3.30.0 accept an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for an RDSTLS_TYPE_AUTHREQ message. This leaves resultCode at RDSTLS_RESULT_SUCCESS, allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, and password checks. The issue is categorized under [CWE-287] Improper Authentication and is fixed in FreeRDP 3.30.0.

Critical Impact
A remote, unauthenticated attacker can bypass RDSTLS authentication on FreeRDP-based servers, gaining access without valid credentials or a matching RedirectionGuid.

Affected Products

FreeRDP versions prior to 3.30.0 (server-side RDSTLS handler)
Applications and gateways embedding the vulnerable libfreerdp core
Any RDP server deployment relying on FreeRDP's RDSTLS authentication

Discovery Timeline

2026-08-11 - CVE-2026-73241 published to NVD
2026-08-11 - Last updated in NVD database
FreeRDP 3.30.0 - Fix released via commit b05a951 and pull request #13065

Technical Details for CVE-2026-73241

Vulnerability Analysis

The vulnerability stems from a protocol state-machine flaw in FreeRDP's server-side RDSTLS implementation. RDSTLS is a Microsoft-defined authentication protocol layered over TLS that validates a client's RedirectionGuid along with username, domain, and password before granting a session. The server state machine expects to receive an RDSTLS_TYPE_AUTHREQ PDU containing these credentials.

In vulnerable builds, rdstls_server_authenticate fails to enforce the expected message type. When a client sends an RDSTLS_TYPE_CAPABILITIES PDU out of sequence, the server processes it without transitioning through the authentication check. The internal resultCode variable retains its initial value of RDSTLS_RESULT_SUCCESS, and the server proceeds as if authentication had succeeded.

Root Cause

The root cause is insufficient state and message-type validation in libfreerdp/core/rdstls.c. The server accepts unexpected PDUs during the authentication handshake instead of rejecting them or resetting resultCode to a failure value. This is a classic authentication bypass [CWE-287] arising from a protocol implementation trusting client-supplied message flow.

Attack Vector

The attack requires network access to a FreeRDP server that negotiates RDSTLS. An unauthenticated remote attacker initiates an RDP connection, completes the TLS handshake, then transmits an RDSTLS_TYPE_CAPABILITIES PDU at the point where the server expects RDSTLS_TYPE_AUTHREQ. The server processes the capabilities message, leaves the success flag intact, and grants session access without validating credentials or the RedirectionGuid.

// Patch excerpt from libfreerdp/core/rdstls.h
 FREERDP_LOCAL void rdstls_free(rdpRdstls* rdstls);
 
 WINPR_ATTR_MALLOC(rdstls_free, 1)
-WINPR_ATTR_NODISCARD
 FREERDP_LOCAL rdpRdstls* rdstls_new(rdpContext* context, rdpTransport* transport);
 
 WINPR_ATTR_NODISCARD
// Source: https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695
// The commit tightens RDSTLS state and bounds checks so the server rejects
// out-of-order PDUs and no longer defaults resultCode to success.

Detection Methods for CVE-2026-73241

Indicators of Compromise

RDP sessions established against FreeRDP-based servers without a preceding RDSTLS_TYPE_AUTHREQ exchange.
Successful RDP logins lacking a corresponding credential validation event in application logs.
Unexpected client source IP addresses initiating RDSTLS handshakes followed by immediate capability negotiation.

Detection Strategies

Inspect RDP protocol traffic for RDSTLS_TYPE_CAPABILITIES PDUs sent before an RDSTLS_TYPE_AUTHREQ PDU within a single session.
Correlate FreeRDP server-side logs with authentication events to identify sessions that reach the post-authentication state without credential submission.
Alert on FreeRDP binaries running versions earlier than 3.30.0 on internet-facing or DMZ hosts.

Monitoring Recommendations

Deploy network sensors on TCP/3389 and any custom RDP ports to capture RDSTLS handshake sequences for offline analysis.
Enable verbose FreeRDP server logging to record RDSTLS state transitions and PDU types processed per session.
Monitor process and network telemetry for unexpected child processes spawned under FreeRDP server contexts following unauthenticated connections.

How to Mitigate CVE-2026-73241

Immediate Actions Required

Upgrade all FreeRDP server deployments to version 3.30.0 or later, which contains the fix from commit b05a951.
Inventory internal applications and appliances that embed libfreerdp and coordinate updates with the respective vendors.
Restrict RDP exposure to trusted networks or VPN-fronted access until patching is complete.

Patch Information

The fix is delivered in FreeRDP Release 3.30.0. The change is tracked in GitHub Pull Request #13065 and applied via commit b05a9510. Details are published in the FreeRDP Security Advisory GHSA-rqgv-grx4-xm6x. The patch tightens RDSTLS state and bounds checks so out-of-order PDUs no longer leave resultCode at RDSTLS_RESULT_SUCCESS.

Workarounds

Disable RDSTLS as an accepted security protocol on FreeRDP-based servers and require alternative authentication such as NLA where feasible.
Terminate RDP sessions at an authenticated gateway that enforces credential validation before forwarding traffic to FreeRDP backends.
Apply network segmentation and firewall rules limiting inbound RDP to a small set of administrative source addresses.

bash

# Verify installed FreeRDP version and upgrade
xfreerdp --version

# Debian/Ubuntu example after distribution package update
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Build from source at the fixed tag
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.30.0
cmake -B build -S . && cmake --build build