A Cross‑Site Request Forgery vulnerability exists in the Flutter URI scheme handler of RustDesk Client, allowing an attacker to invoke the rustdesk://password/ URI and set a permanent password for the user without performing a privilege check or prompting for confirmation. This flaw effectively bypasses authorization controls, granting an attacker unauthorized control of the user’s account. The weakness is categorized as CWE‑285 (Authorization Bypass Through User‑Controlled Key) and CWE‑352 (Cross‑Site Request Forgery).

The issue affects all RustDesk Client platforms, including Windows, macOS, Linux, iOS, and Android, through the Flutter URI scheme handler and its FFI bridge modules. Versions up to and including 1.4.5 are vulnerable.

The CVSS base score of 9.3 indicates a critical severity, while the current EPSS score of less than 1% suggests the likelihood of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker able to invoke the rustdesk://password URI—such as via a malicious webpage or compromised application—without user confirmation or privilege checks; this inference is drawn from the description that the URI handler sets a permanent password. Exploitation requires that the victim has RustDesk Client installed and the rustdesk:// scheme registered.