CVE-2026-30789 describes a vulnerability in RustDesk Client (up to version 1.4.8) where the password hashing mechanism uses insufficient computational effort, relying on double SHA256 without a slow key derivation function. The authentication proof is constructed as SHA256(SHA256(password + salt) + challenge), with both salt and challenge generated solely by the server. This allows an attacker controlling or intercepting the server API or relay to choose salt and challenge values, capture the resulting proof, and perform offline brute forcing to recover the password. Although the challenge changes per connection preventing replay attacks, the lack of a slow hashing function enables efficient offline attacks. Online brute force protections exist but do not mitigate offline password recovery.

An attacker who can act as or intercept the server can capture authentication proofs and perform offline brute force attacks to recover user passwords. This compromises user credentials without requiring repeated online authentication attempts. The vulnerability weakens the authentication security of RustDesk Client, potentially allowing unauthorized access if passwords are recovered. However, replay attacks are not feasible due to per-connection challenge regeneration. The overall severity is medium based on CVSS 5.7.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, relying on strong, high-entropy passwords may reduce the risk of offline brute forcing. The existing online brute force protections do not mitigate offline attacks. Avoid using RustDesk Client versions up to 1.4.8 in high-risk environments where password compromise would be critical.