CVE-2026-91949

EUVD-2026-78806
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.3 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
freerdpfreerdp
3.0.0 ≤
𝑥
< 3.31.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
2.11.7+dfsg1-6~deb12u1
fixed
freerdp3
forky
3.31.1+dfsg-1
fixed
sid
3.31.1+dfsg-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass