Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-30789 is a critical-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Rustdesk Rustdesk. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30789 is an Authentication Bypass by Capture-replay and Use of Password Hash With Insufficient Computational Effort vulnerability in the rustdesk-client RustDesk Client. It affects client login and peer authentication modules on Windows, macOS, Linux, iOS, and Android platforms, allowing reusing session IDs (aka session replay). The issue is associated with program files src/client.rs and routines such as hash_password() and login proof construction. This vulnerability impacts RustDesk Client versions through 1.4.5 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWEs 294 and 916.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network. By capturing and replaying session data, adversaries can bypass authentication mechanisms, achieving high confidentiality, integrity, and availability impacts, such as unauthorized access to client sessions and peer connections.
Advisories providing details on mitigations and patches are available at the following references: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, https://rustdesk.com/docs/en/client/, and https://www.vulsec.org/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9834
Vulnerability Data
Authentication Bypass by Capture-replay, Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Reusing Session IDs (aka Session Replay). This vulnerability is associated…
more
with program files src/client.Rs and program routines hash_password(), login proof construction. This issue affects RustDesk Client: through 1.4.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1V11.4.2
Mitigating Controls (NIST 800-53 r5) AI
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Cryptographic protection mandates selection and use of approved algorithms whose parameters can include sufficient work factors for password hashing.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Authenticator management requires secure generation, distribution, and storage of passwords, directly enforcing computationally expensive hashing schemes.
Protection of information at rest requires cryptographic safeguards on stored password hashes, reducing exposure to offline cracking.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
Secure authentication mechanisms directly prevent replay attacks by requiring fresh, non-replayable credentials or tokens.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
Application security requirements can mandate replay-resistant authentication designs, but the control itself does not prescribe the technical measures.
Secure coding practices include implementing password storage with adequate computational effort.