CVE-2026-109953

MediumCVSS 5.3/10Last modified Oct 21, 2026

Description

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	>= 3.0.0, < 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhxw-3hj9-9hqhExploit, Vendor Advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-cleartext-credential-disclosure-via-restricted-adminThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhxw-3hj9-9hqhExploit, Vendor Advisory

Timeline

Published: Oct 13, 2026
Last modified: Oct 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1099546.5Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any cl CVE-2026-1099555.3Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip pref CVE-2026-1099567.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by su CVE-2026-1099574.3EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to CVE-2026-1099584.3EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddres CVE-2026-1099594.3EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted CVE-2026-109966.5Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a CVE-2026-1099607.7Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and Java CVE-2026-1099618.5Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into CVE-2026-1099624.3Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL serv CVE-2026-1099634.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because CVE-2026-1099645.6ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds