Improper Certificate Validation in FreeRDP - CVE-2026-67294
Published: July 16, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU137825
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67294
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass TLS server certificate purpose validation.
The vulnerability exists due to improper certificate validation in tls_verify_certificate(), freerdp_certificate_verify(), and x509_utils_verify() when verifying the server certificate during the client-side TLS handshake. A remote attacker can present a trusted certificate that matches the target hostname but is valid only for client authentication to bypass TLS server certificate purpose validation.
Exploitation requires that the FreeRDP client trust the issuing certificate authority or chain and that the certificate hostname match the target.
Affected software
FreeRDP
How to mitigate CVE-2026-67294
Install security update from vendor's website.
FreeRDP - update to 3.29.0