FreeRDP: TLS certificate validation bypass (CVE-2026-121392)
FreeRDP contains a certificate validation vulnerability in tls_verify_certificate() that allows man-in-the-middle attackers to intercept RDP sessions. A public PoC exploit has been published.
CVE search metadata
CVE search record: CVE-2026-121392. Severity: high. CVSS: 7.4. KEV: no. Product: Freerdp. Brief: FreeRDP: TLS certificate validation bypass (CVE-2026-121392). Brief link: https://feed.craftedsignal.io/briefs/2026-11-freerdp-tls-bypass/
CVE search record: CVE-2026-121953. Severity: critical. CVSS: 9.8. KEV: no. Product: Freerdp. Brief: FreeRDP: TLS certificate validation bypass (CVE-2026-121392). Brief link: https://feed.craftedsignal.io/briefs/2026-11-freerdp-tls-bypass/
Triage facts
Revision 2- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 10 public sources
- Freshness
- Revision 2Nov 4, 17:09 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- C2Likely
Revision history 1 entry · Revision 2
- Revision 2
added CVE-2026-121953
Changed: affected_vendors, claim_state, cpes, cves, lastmod, references, updates
Sources: 1
FreeRDP contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content. A proof-of-concept exploit is available on Sploitus.