FreeRDP implements an HTTP request routine that completes TLS handshakes without verifying the server certificate chain. This flaw allows an attacker who can intercept or redirect traffic on the RDP channel to impersonate login.microsoftonline.com during the Azure AD authentication flow. The attacker can capture OAuth authorization codes and substitute the OpenID discovery document, enabling the theft of access tokens and subsequent hijacking of user sessions. The weakness is classified as CWE‑295.

FreeRDP releases prior to version 3.32.0 are vulnerable. Any deployment that actively uses the freerdp_http_request function to communicate with Azure AD endpoints via HTTPS is affected, regardless of operating system or client configuration.

The vulnerability is rated high with a CVSS score of 7.4. Although an EPSS score is not available, the requirement for only on‑path network access and the ability to intercept RDP traffic make exploitation plausible. The issue is not yet listed in CISA KEV, but its potential to compromise authentication credentials warrants immediate attention. Exploitation would involve redirecting traffic to a malicious server that presents a forged certificate, then capturing the OAuth authorization code and the OpenID endpoint configuration.