CVE-2026-109245

6.8Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.8Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: CWE-295

Impact

Man-in-the-middle attackers can intercept Azure AD authentication to capture OAuth authorization codes and hijack user sessions. The attacker must be in an on-path network position between the client and login.microsoftonline.com while a user initiates an RDP connection.

Root cause

The freerdp_http_request() function completes TLS handshakes without validating the server's certificate chain.

Affected systems

FreeRDP 3.0.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading immediately is not possible, avoid using Azure AD authentication flows over untrusted networks.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109245