FreeRDP before version 3.29.0 (specifically versions <= 3.28.0) has multiple TLS certificate identity validation weaknesses in the functions tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Instead of using OpenSSL's length-aware identity validation APIs, FreeRDP performs custom string matching that truncates DNS SAN values at embedded NUL bytes, accepts a matching Common Name even if DNS SAN entries do not match, and accepts IP-literal targets via DNS/CN matching without verifying iPAddress SANs. These issues allow an attacker presenting a trusted or misissued certificate with crafted fields to bypass server identity verification, weakening TLS server authentication.

An attacker who can present a trusted or misissued TLS certificate exploiting these validation weaknesses can bypass FreeRDP's server identity verification. This compromises the authenticity of the TLS server, potentially enabling man-in-the-middle attacks, data interception, or impersonation of legitimate servers. The CVSS score of 9.8 indicates critical impact with high confidentiality, integrity, and availability consequences.

A fix is available in FreeRDP version 3.29.0 that addresses these TLS certificate validation weaknesses. Users should upgrade to version 3.29.0 or later to remediate this vulnerability. Until upgraded, users should be aware of the risk of TLS server authentication bypass. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.