CVE-2026-42218 — XRDP is vulnerable to a server timing attack, leading to user enumeration
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing time…
Published: 2026-07-20 · CVSS: 5.3 · CVSS 3.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7