CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

• CWE-295

• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319fPatch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-89c6-jjrw-96h4Exploit, Vendor Advisory
• https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-eku-bypassPatch, Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-89c6-jjrw-96h4Exploit, Vendor Advisory

Published

Aug 1, 2026

Last Modified

Sep 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67289FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not…9.8
• CVE-2026-6729HKUDS OpenHarness prior to PR #159 remediation contains a se…7.6
• CVE-2026-67290FreeRDP before 3.29.0 contains a heap out-of-bounds read vul…7.5
• CVE-2026-67291FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…7.5
• CVE-2026-67292FreeRDP before 3.29.0 contains a buffer over-disclosure vuln…6.5
• CVE-2026-67293FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…4.2
• CVE-2026-67295FreeRDP before 3.29.0 fails to properly validate server-supp…6.3
• CVE-2026-67296FreeRDP before 3.29.0 contains a denial of service vulnerabi…7.5
• CVE-2026-67297FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIM…7.5
• CVE-2026-67298FreeRDP versions 3.28.0 and earlier contain a heap buffer ov…7.5
• CVE-2026-67299FreeRDP before 3.29.0 contains a client-side heap use-after-…7.5
• CVE-2026-6730IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer ov…9.8