CVE-2026-30793
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
Summary
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
Original description
The description as published by the source.
Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword().
This issue affects RustDesk Client: through 1.4.5.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vulsec.org
- package github.com
- package github.com
- package github.com
- report docs.google.com
- web github.com