Missing authorization in RustDesk Client allows an attacker to manipulate application API messages through a man‑in‑the‑middle or malicious URI, enabling the client to be silently re‑homed to an attacker‑controlled server. This flaw permits unauthorized modification of connection settings and grants the attacker full control of subsequent remote sessions, potentially exposing sensitive data and remote operations. The weakness is classified under CWE-749 (Deserialization of Untrusted Data) and CWE-862 (Missing Authorization).

The vulnerability affects the RustDesk Client (rustdesk-client) on Windows, macOS, Linux, iOS, and Android, through versions up to and including 1.4.5. Any installation that accepts URI scheme handlers or imports configuration files is at risk.

The CVSS score of 9.3 marks it as critical, yet the EPSS score is less than 1 % indicating a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver a crafted rustdesk:// URI or configuration file, or to intercept the client’s configuration import process. Because no user confirmation is performed, the client silently applies the malicious settings. The obvious attack path is through phishing or compromised directories where an attacker can drop a malicious config. Even though the likelihood is low, the potential impact is high, justifying a prompt response.