The vulnerability in FreeRDP prior to version 3.30.0 involves the RDSTLS handshake where the server dispatches inbound PDUs based only on the attacker-controlled wire pduType, without verifying that the PDU matches the expected step in the handshake. Because the rdpRdstls object is zero-initialized, its resultCode defaults to success. An attacker can send a Capabilities PDU instead of the required Authentication Request PDU, causing the server to respond with an authentication success response and treat the session as authenticated without checking any password, redirection GUID, or auto-reconnect cookie. This affects the FreeRDP 3.x series including version 3.27.1 and the master branch at the time of the advisory. No patched version was available at the time of publication.

An unauthenticated remote attacker can bypass server-side authentication in the RDSTLS handshake, gaining unauthorized access without providing valid credentials. This results in a high-severity security risk as confidentiality is compromised, although integrity and availability are not directly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling RdstlsSecurity or restricting access to trusted clients to mitigate risk.