CVE-2026-57850

if self.authorized {
    // any message type is processed here — no check against AuthConnType
}

let allowed = match conn_type {
    AuthConnType::Remote       => true,
    AuthConnType::FileTransfer => Self::is_file_transfer_scoped_message(msg),
    AuthConnType::PortForward  => false,
    AuthConnType::ViewCamera   => Self::is_view_camera_scoped_message(msg),
    AuthConnType::Terminal     => Self::is_terminal_scoped_message(msg),
};

if self.authorized {
    if matches!(msg.union.as_ref(), Some(message::Union::LoginRequest(_))) {
        return true;
    }
    if let Some(message) = self.authorized_scope_violation(&msg) {
        return self.handle_authorized_scope_violation(message).await;
    }
}

1. Attacker obtains (or is granted) authorization for a limited connection
   type only — e.g. AuthConnType::FileTransfer
2. self.authorized flips to true; pre-1.4.9, the server never re-checks
   which AuthConnType that authorization actually covers
3. Attacker sends MouseEvent / KeyEvent / ScreenshotRequest on the same
   connection — message types reserved for AuthConnType::Remote
4. Vulnerable server: processes them anyway (drives input, returns screen
   content) — attacker acts outside the scope they were actually granted
5. Patched server (>= 1.4.9): rejects each message, raises a
   SessionScopeViolation alarm, disconnects

# Run the simulation (default: attacker holds FileTransfer-only auth)
python3 CVE-2026-57850_POC.py

# Simulate from a different limited scope
python3 CVE-2026-57850_POC.py --conn-type ViewCamera

# Optional: sanity-check that a local checkout matches the described
# vulnerable/patched code shape (looks for AuthConnType, SessionScopeViolation,
# authorized_scope_violation, is_view_camera_scoped_message in
# src/server/connection.rs)
python3 CVE-2026-57850_POC.py --repo-root /path/to/rustdesk