CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
Attackers can bypass TLS server identity verification in FreeRDP by exploiting custom certificate validation logic, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66402?
CVE-2026-66402 is a critical vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.
Weakness: CWE-295
Which versions are affected by CVE-2026-66402?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-66402?
Upgrade to a fixed version.
Is CVE-2026-66402 being exploited?
There is no known exploitation of CVE-2026-66402 in the wild and no public exploit code.
Other vulnerabilities in Freerdp Freerdp
Sources
Also known as DEBIAN-CVE-2026-66402, GHSA-43hh-p3vw-hfx3, GHSA-759r-h698-g7xj, UBUNTU-CVE-2026-66402.