#10256·FreeRDP

mstshash is set to the username

Author: hedwigzCreated Jun 5, 2024Updated Jun 16, 2026
Labelsfeature

The Client X.224 Connection Request has a field routingToken which is optional. FreeRDP sets this value to the username (code). Since this message is sent before the connection is encrypted, it potentially leaks usernames to the network.

I tested to see whether mstsc sets this field to the username and I found that it does not