Executive brief
xrdp is an open-source tool that allows users to remotely access a computer's desktop. A security flaw in the login screen allows an attacker to figure out which usernames exist on the system by measuring how long the server takes to respond to login attempts. This information can be used to facilitate more targeted attacks, such as password guessing or social engineering.
Technical details
A timing side-channel vulnerability (CWE-204) exists in the xrdp login interface due to observable response discrepancy. The server takes different amounts of time to process login requests depending on whether the provided username exists on the system. A remote, unauthenticated attacker can measure these processing time differences to verify valid usernames. This issue affects versions up to and including 0.10.6 and has been addressed in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-06-15: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE published to NVD