Timing Side-Channel Vulnerability in xrdp Versions Prior to 0.10.6.1

CVE-2026-42218

What is CVE-2026-42218?

The xrdp open-source RDP server, in its versions up to 0.10.6, has a vulnerability in its login interface that allows a remote attacker to exploit timing discrepancies in response processing. This flaw enables attackers to deduce valid usernames through timing attacks, potentially leading to unauthorized access through username enumeration. The issue has been addressed in the updated release version 0.10.6.1.

References