Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-67293: FreeRDP 3.28.0 and earlier accepts fake SSL certificates
CVE-2026-67293
CVE-2026-67293
Summary
FreeRDP versions 3.28.0 and earlier have a security issue that can allow an attacker to pretend to be a trusted server. This is because FreeRDP does not properly check the identity of the server, which can lead to a man-in-the-middle attack. To fix this issue, update to FreeRDP version 3.29.0 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freerdp | freerdp | < 3.29.0 |
Original title
FreeRDP before 3.29.0 Improper Certificate Hostname Validation
Original description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
mitre CVSS3.1
4.2
Vulnerability type
CWE-295
Improper Certificate Validation
Published: 1 Aug 2026 · Updated: 5 Aug 2026 · First seen: 1 Aug 2026