Improper Certificate Validation Vulnerability in FreeRDP by FreeRDP

CVE-2026-109245

What is CVE-2026-109245?

FreeRDP versions prior to 3.32.0 are prone to an improper certificate validation vulnerability in the method freerdp_http_request() found in libfreerdp/utils/http.c. This issue allows attackers to complete TLS handshakes without verifying the server certificate chain. Consequently, on-path attackers have the potential to impersonate the legit login.microsoftonline.com during the Azure AD authentication flow. This impersonation enables the capture of OAuth authorization codes and the possibility to substitute the OpenID discovery document, raising significant security concerns.

References