CVE-2026-30795
RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Summary
RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Original description
The description as published by the source.
Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop modules) allows Sniffing Attacks. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines Heartbeat JSON payload construction (preset-address-book-password).
This issue affects RustDesk Client: through 1.4.5.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vulsec.org
- package github.com
- package github.com
- report docs.google.com
- web github.com