FreeRDP servers that enable RDSTLS security before version 3.30.0 are vulnerable to an authentication bypass. The flaw occurs during the RDSTLS handshake, where the server processes inbound protocol data units solely based on the client‑supplied PDU type without verifying that the received PDU matches the expected message for the current handshake step. An unauthenticated attacker can send a Capabilities PDU in place of the required Authentication Request PDU. The server accepts this as a successful authentication, sets the resultCode to SUCCESS, and grants the session without checking any credential, redirection GUID, or auto‑reconnect cookie. This allows the attacker to establish a session as any user, potentially leading to unauthorized remote execution or data disclosure. The weakness is classified as CWE‑287, Authentication Bypass.

The vulnerability affects FreeRDP releases from version 2.11.8 through 3.26.0, as well as any master HEAD builds that have not yet received the fix. All FreeRDP server binaries that enable RDSTLS security (RdstlsSecurity = TRUE) are susceptible.

The CVSS base score is 8.7, indicating high severity. No EPSS score is provided in the advisory, so exploitation probability cannot be inferred from EPSS data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring only an RDSTLS session initiation from the client side; no authentication or elevated privileges are needed. An attacker can send a crafted Capabilities PDU over the network to bypass authentication and immediately gain access to the target system.