CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.

• CWE-287

• https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695Patch
• https://github.com/FreeRDP/FreeRDP/pull/13065Issue Tracking, Patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6xExploit, Mitigation, Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6xExploit, Mitigation, Vendor Advisory

Published

Aug 11, 2026

Last Modified

Sep 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73236Incorrect Authorization vulnerability in Apache Syncope. …7.5
• CVE-2026-73237XSS vulnerability in Markdown handling in Apache Allura. Th…6.1
• CVE-2026-73238XSS vulnerability in code display in Apache Allura. This is…6.1
• CVE-2026-73239Insecure Direct Object Reference (IDOR) due to missing permi…6.5
• CVE-2026-7324Memory safety bugs present in Thunderbird 150.0.0. Some of t…7.3
• CVE-2026-73240Specifically crafted inputs may lead to git argument injecti…9.8
• CVE-2026-73242FreeRDP is a free implementation of the Remote Desktop Proto…9.1
• CVE-2026-73243kkFileView is a universal file online preview project based …5.8
• CVE-2026-73244kkFileView is a universal file online preview project based …5.3
• CVE-2026-73245Kestra is an open-source, event-driven orchestration platfor…6.5
• CVE-2026-73246Kestra is an open-source, event-driven orchestration platfor…7.5
• CVE-2026-73247Kestra is an open-source, event-driven orchestration platfor…8.6