PT-2026-23455 · Rustdesk · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30789

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A flaw exists in RustDesk Client that allows for authentication bypass through capture-replay attacks and the use of a password hash with insufficient computational effort. This impacts the client login and peer authentication modules. The issue stems from the reuse of session IDs, also known as session replay. The vulnerability is related to files within the src/client.Rs directory and routines such as hash password() and login proof construction.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

Weakness Enumeration

CWE-294

CWE-916

Related Identifiers

CVE-2026-30789

Affected Products

Rustdesk Client

References · 6

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30789 · Security Note
• https://vulsec.org · Note
• https://t.me/CVEtracker/46460 · Telegram Post
• https://rustdesk.com/docs/en/client · Note
• https://twitter.com/CVEnew/status/2029654731233083807 · Twitter Post