CVE-2026-30793
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
Résumé
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword().
This issue affects RustDesk Client: through 1.4.5.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory vulsec.org
- package github.com
- package github.com
- package github.com
- report docs.google.com
- web github.com