CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security (TLS) server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by impersonating trusted authentication servers during user login. This allows the attacker to intercept sensitive authorization credentials and tamper with authentication responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.