A flaw in FreeRDP’s shadow server allows an unauthenticated attacker to send input protocol data units during the Confirm Active state before authentication is completed. This permits the injection of synthetic keystrokes into the target user’s X11 session via XTEST, which can be used to issue malicious commands or otherwise influence the host’s desktop environment. The vulnerability is specifically a lack of authentication checks (CWE‑306).

The issue affects all FreeRDP releases from version 3.0.0 up to but not including 3.32.0. The vulnerability resides in the shadow server component used for session mirroring or remote observation.

With a CVSS score of 8.7 the vulnerability is classified as High. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw without authenticating, negotiating a TLS‑only RDP session, and sending a malicious input packet that bypasses the Confirm Active check, injecting keystrokes into the session before any authentication has taken place.