CVE-2026-72746

The CVSS 7.5 assigned to CVE-2026-72746 fundamentally mischaracterizes this flaw. This is not a missing authorization check — it is a protocol state machine collapse that renders authentication semantics meaningless. The RDSTLS handshake expects a specific sequence: client sends Authentication Request, server responds, client sends Capabilities. The vulnerability exposes that the server never validates incoming PDU type against the expected state. It evaluates only whether the wire format is valid and whether resultCode is 0. Because resultCode is calloc-zeroed and rdstls_process_capabilities() never explicitly sets it, the field defaults to zero — which the handler interprets as SUCCESS. An attacker who sends a properly formatted Capabilities PDU at the right moment inherits a pre-successified response object. The server then dispenses AUTHRSP with SUCCESS. Nothing actually occurred. No password was evaluated, no redirection GUID was checked, no auto-reconnect cookie was validated. Authentication was not bypassed — it was replaced with a null operation that happens to return the same success signal as a legitimate handshake. This vulnerability affects FreeRDP deployments with RdstlsSecurity = TRUE enabled. This is a hardening flag, not a default configuration, which means the attack surface is narrower than the CVSS suggests — but the targets that do use this flag are precisely the ones where TLS-level authentication matters: jump boxes, privileged access workstations, and environments where RDP passthrough represents lateral movement risk. Low adoption does not mean low consequence; it means the deployments that matter most are the ones exposed. The fix in version 3.30.0 adds PDU-type validation, but the historical pattern is concerning. Similar state machine patches in TLS renegotiation, RTSP implementations, and H.323 stacks have been revisited within six to eighteen months when researchers found additional valid PDU types that could be sent out of sequence. More fundamentally, the patch likely addresses this specific Capabilities PDU sequence without fixing the underlying assumption: that resultCode = 0 from calloc is semantically equivalent to resultCode = SUCCESS. One means explicitly set to success; the other means never touched. Future protocol extensions could reintroduce the same gap. Defenders should identify whether RdstlsSecurity is enabled in their FreeRDP deployments. If it is, prioritize updating to 3.30.0 or later. Monitor the FreeRDP issue tracker for subsequent state machine-related patches — the probability of follow-up disclosures on this code path is non-trivial given the structural pattern. The blast radius is concentrated in high-value hardening scenarios, but the authentication infrastructure in those scenarios is fully compromised by this flaw.

Reviewed through automated stages and approved by a human before publication.