CVE-2026-73241

CVE-2026-73241 is a state machine vulnerability in FreeRDP's RDSTLS handler where the server accepts CAPABILITIES PDUs before the AUTHREQ response completes, bypassing authentication checks on RedirectionGuid, username, domain, and password. The root cause isn't complex logic—it's a missing sequence enforcement that exists because the RDP specification describes the AUTHREQ-then-CAPABILITIES order implicitly rather than making it an explicit code contract. This matters beyond the specific fix because it represents a pattern, not an isolated bug. RDP has dozens of sub-protocols and extension channels, and handshake handlers throughout FreeRDP likely have similar implicit sequence assumptions that have never been fuzzed with out-of-order PDUs. The RDSTLS handler wasn't dead code—it was actively shipped in every FreeRDP server binary—but it wasn't actively security-tested. Production activation without corresponding security testing activation is the specific failure mode here. The protocol worked correctly for legitimate clients following the happy path, so no feedback loop ever indicated the state machine was incomplete. The uncomfortable reality is that this class of vulnerability—implicit handshake contracts that only fail under adversarial input—probably exists in other protocol handlers in FreeRDP and in RDP implementations generally. The fix in 3.30.0 adds proper state tracking, which is straightforward in retrospect, but that simplicity is exactly what makes the vulnerability class dangerous: once you know to look for protocol sequence violations, they're easy to find, which means systematic enumeration should have caught this earlier. Prioritize auditing other handshake handlers in libfreerdp/core/—particularly those handling TLS, authentication, or redirection—for missing state validation. If your deployment uses FreeRDP server components, confirm the version is 3.30.0 or later. More broadly, treat this as a signal that protocol state machines need explicit contract enforcement rather than relying on 'it works in practice' as a security boundary.

Reviewed through automated stages and approved by a human before publication.