The vulnerability in the FreeRDP client allows an attacker to force the client to accept a lower‑security protocol, specifically PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX, without verifying that the selected protocol is enabled by the user. By doing so, the client performs authentication with an all‑zero cookie and then receives the user’s cleartext password in the Client Information PDU. This results in the compromise of user credentials and potentially all sensitive data the user can access.

FreeRDP clients running version 3.0.0 up to, but not including, 3.32.0 are affected. No other versions or vendor products are listed in the advisory.

The vulnerability scores a CVSS 6, indicating moderate severity. EPSS is not available and the CVE is not listed in CISA’s KEV catalog. An attacker must be able to control or impersonate the RDP server, either by hosting a malicious server or by performing a man‑in‑the‑middle attack. With that capability, the downgrade can occur during the standard RDP negotiation. Because the impact is the disclosure of cleartext passwords, the risk is significant for systems where users log in with sensitive credentials.