Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109245: FreeRDP may let attackers spoof Azure login

CVE-2026-109245 · published 3 days ago

Summary

Versions of FreeRDP 3.0.0 up to 3.31.0 on Debian can complete a secure connection without checking the server's certificate. This means a malicious network operator could pretend to be Microsoft’s Azure login site and steal authentication codes. Upgrade FreeRDP to version 3.32.0 or later to restore proper certificate checking.

What to do

Update debian freerdp3 to version 3.32.0+dfsg-1.
Update freerdp freerdp to version 3.32.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	freerdp2	All versions
Debian:13	debian	freerdp3	All versions
Debian:14	debian	freerdp3	< 3.32.0+dfsg-1 Fix: upgrade to 3.32.0+dfsg-1
–	freerdp	freerdp	< 3.32.0

Original advisory text

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h44v-39x6-9xvg Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-109245 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1092... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-109245 Vendor Advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-improper-certif... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published12 Oct 2026

Updated16 Oct 2026

First seen12 Oct 2026

Sources

CVE-2026-109245 · NVD

DEBIAN-CVE-2026-109245 · OSV

CVE-2026-109245 · OSV

GHSA-h44v-39x6-9xvg · GHSA

CVE-2026-109245 · MITRE

Track software like this

Free during beta