A timing side‑channel in the xrdp RDP server’s login interface allows a remote attacker to measure the time the server takes to process authentication attempts. By analyzing differences in response time, an adversary can determine whether a particular username exists on the target machine, leading to unauthorized disclosure of valid account names. The flaw is cataloged as a timing attack (CWE‑204).

The vulnerability affects the neutrinolabs xrdp server, versions 0.10.6 and earlier. The issue was fixed in release 0.10.6.1, so any instance running 0.10.6 or older is susceptible.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is noted as < 1%, suggesting a very low probability of exploitation in the wild, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker can send repeated login attempts over the network and measure the response timing to enumerate usernames. This requires only unauthenticated network access to the RDP port and does not provide code execution or privilege escalation. The attack vector is therefore a network‑based timing attack, observable without authentication.