FreeRDP version 3.0.0 through 3.31.x suffers from a CWE-522 insufficiently protected credentials vulnerability, failing to suppress credential delegation when the /restricted-admin option is used and sending the cleartext password inside the CredSSP block. This allows any party that can intercept or control the RDP session to decode the TSPasswordCreds and the Client Info PDU and recover the administrative domain, username, and password. The attacker gains reusable credentials without user interaction, enabling potential lateral movement or privilege escalation.

The affected product is the FreeRDP RDP client; all releases from version 3.0.0 up to but not including 3.32.0 that use the /restricted-admin option are vulnerable. No other vendors or editions were identified as impacted.

The CVSS score of 6 indicates moderate severity, and the exploitation requires the client to connect to an RDP server that the attacker can compromise or eavesdrop on. While an EPSS score is not published, the cleartext transmission of credentials makes the attack straightforward for an adversary with network visibility on RDP traffic. The vulnerability is not listed in CISA's KEV, but the theft of domain administrator credentials poses a high operational risk and could lead to total domain compromise if credentials are reused.