Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:17 FreeRDP: FreeRDP: Server Identity Verification Bypass via TLS Certificate Validation Weaknesses 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-222

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

A flaw was found in FreeRDP. This flaw involves multiple weaknesses in how FreeRDP validates TLS (Transport Layer Security) certificates. FreeRDP's custom validation logic can incorrectly process DNS Subject Alternative Name (SAN) values, accept Common Names without proper comparison to other SAN entries, and fail to validate IP address SANs for IP-literal targets. An attacker, by presenting a specially crafted certificate, could exploit these weaknesses to bypass server identity verification, potentially allowing them to impersonate a legitimate server and compromise the security of the connection.

This issue is classified as Moderate severity because successful exploitation requires an attacker to be in a man-in-the-middle network position using a specially crafted certificate, allowing them to bypass server identity verification and impersonate a target server without directly enabling code execution or host system compromise. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Fix deferred freerdp Red Hat Enterprise Linux 9 Fix deferred freerdp https://www.cve.org/CVERecord?id=CVE-2026-66402 https://nvd.nist.gov/vuln/detail/CVE-2026-66402 https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3 https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass