AIKIDO-2026-633820

TL;DR

The server-side RDSTLS handshake dispatches inbound PDUs purely on the wire pduType without checking that the PDU is the one required at the current step, and the state object is zero-initialised so resultCode starts at the success value. A client waiting to send credentials can instead send a Capabilities PDU, which is accepted without ever evaluating a password, redirection GUID, or reconnect cookie, and the server marks the connection authenticated. This lets a remote unauthenticated client bypass RDSTLS authentication on a server or proxy that enables it. The fix requires an authentication-request PDU at the auth step and initialises the result to a denial value.