xrdp’s Xvnc backend for UNIX domain sockets was vulnerable to an authentication bypass. A local attacker who is already authenticated to the host can launch the Xvnc process without any further authentication, allowing that attacker to view or control the desktop session of any other user on the same system. This flaw directly undermines session isolation and enables unauthorized access to active user desktops, although it does not provide full system compromise. The weakness is a classic authentication failure (CWE-287) and an improper authorization control (CWE-306).

The affected product is the neutrinolabs xrdp server. All releases up to and including 0.10.6 are impacted; the issue was fixed in 0.10.6.1. Only the Xvnc backend over UNIX domain sockets is vulnerable; other backends, such as xorgxrdp or Xvnc using TCP sockets, are not affected. Users running xrdp on RHEL 9 or other distributions should check the installed version and upgrade if necessary.

The CVSS score for this vulnerability is 8, indicating a high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a local authenticated user, which means that the threat is limited to machines where an attacker can obtain user credentials or exploit a local privilege. Once privileges are sufficient, the attacker can bypass session isolation and gain visibility or control over other users’ desktops. The lack of a remote vector and the need for local authentication slightly reduce the exploitation probability, yet the high CVSS highlights the significant impact on confidentiality, integrity, and availability of user sessions.