RustDesk Client Authentication Bypass Vulnerability Allowing Session Replay

An authentication bypass vulnerability has been identified in RustDesk Client versions through 1.4.5, across multiple platforms including Windows, macOS, Linux, iOS, and Android. This vulnerability allows for session replay by reusing session IDs, which can be exploited in the client login and peer authentication modules. The issue arises from the way passwords are hashed and how login proofs are constructed, enabling capture-replay attacks.

Impact

Exploitation of this vulnerability allows for authentication bypass by capturing and reusing session IDs, potentially leading to unauthorized access or actions within the application.