NIXPKGS-2026-0555
GitHub issue
published on 7 Mar 2026
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt accepted
- @mweinelt published on GitHub
RustDesk Server Controls All Handshake Entropy (Salt/Challenge), Enabling Offline Brute-Force
Improper Restriction of Excessive Authentication Attempts, Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Peer authentication, API login modules), rustdesk-server RustDesk Server (OSS) rustdesk-server on Windows, MacOS, Linux (Peer authentication, API login modules) allows Password Brute Forcing. This vulnerability is associated with program files src/server/connection.Rs and program routines Salt/challenge generation, SHA256(SHA256(pwd+salt)+challenge) verification. This issue affects RustDesk Server Pro: through 1.7.5; RustDesk Server (OSS): through 1.1.15.
References
-
https://github.com/rustdesk product
Affected products
rustdesk-server
- =<1.1.15
rustdesk-server-pro
- =<1.7.5
Package maintainers
-
@gaelreyrol Gaël Reyrol <me@gaelreyrol.dev>
-
@tjni Theodore Ni <43ngvg@masqt.com>