The issue came to light after independent security researcher Daniel Wade reported to the Microsoft Security Response Center that, under certain conditions, RDP will continue to accept old passwords for remote access, even after a user has changed their password due to compromise or routine security hygiene. Wade’s findings, detailed in a report by Ars Technica, warn that this behavior undermines the very trust users place in password changes as a means to cut off unauthorized access. Microsoft’s stance leaves millions at risk, highlighting a fundamental disconnect between user expectations of password security and the realities of Windows’ RDP design. Microsoft has confirmed that its Remote Desktop Protocol (RDP) allows users to log into Windows machines using passwords that have already been changed or revoked. The company says it has no plans to change this behavior, describing it as an intentional design decision rather than a security vulnerability. If the password matches any previously valid, cached credential, even one that’s been changed or revoked, it grants access. A Microsoft spokesperson confirmed the company has been aware of the issue since at least August 2023, but maintains that changing the behavior could break compatibility with existing applications.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 02 May 2025 09:20:08 +0000