CVE-2026-109245

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description An improper certificate validation issue exists in the freerdp http request() function within libfreerdp/utils/http.c. This flaw allows TLS handshakes to complete without verifying the server certificate chain. An on-path attacker can exploit this to impersonate login.microsoftonline.com during the Azure AD authentication flow, enabling the capture of OAuth authorization codes and the substitution of the OpenID discovery document.

Recommendations Update FreeRDP to version 3.32.0 or later.