FreeIPA ipa-otpd CVE-2026-14612

Three conditions must be simultaneously satisfied: (1) FreeIPA must be explicitly configured with an external OAuth2/OIDC Identity Provider - this is a non-default, administrator-provisioned configuration; standard FreeIPA deployments using only built-in OTP are not affected; (2) the attacker must control the external IdP endpoint (e.g., compromised or malicious IdP) or successfully perform a man-in-the-middle attack on the network path between the ipa-otpd daemon and the IdP, which drives the AC:H rating; (3) a legitimate FreeIPA user must actively initiate the OAuth2 device authorization flow, providing the required user interaction (UI:R). Exploitation is further limited to the one-byte overwrite boundary, which significantly constrains the reliability and impact achievable beyond daemon denial of service. Environments without external IdP configuration are entirely unexposed.

The CVSS 3.1 score of 4.2 (Medium) accurately reflects a constrained attack surface: high attack complexity (AC:H) requires the attacker to either compromise the external IdP or establish a man-in-the-middle position on the network path between ipa-otpd and the IdP, and user interaction (UI:R) is mandatory - a legitimate user must actively initiate the OAuth2 device authorization flow. The network vector (AV:N) reflects the attacker's network position rather than ease of exploitation. Impact is bounded to limited integrity (I:L) and availability (A:L) with no confidentiality impact (C:N); the vendor description itself qualifies the most likely outcome as limited denial of service, which is consistent with a one-byte boundary overwrite. No EPSS score was provided in the available intelligence. The absence of a CISA KEV entry and no identified proof-of-concept code both support a low urgency rating for most environments. The prerequisite of a non-default external IdP configuration further narrows the realistic vulnerable population to a subset of FreeIPA deployments. CVSS I:L may overstate realistic integrity risk given the one-byte constraint, but is a defensible conservative assessment.

An attacker with a man-in-the-middle position between the FreeIPA server and its configured external OAuth2/OIDC IdP endpoint intercepts the device authorization response and replaces it with a crafted oversized payload. When a legitimate user initiates the OAuth2 device flow - for example, during an MFA login attempt - ipa-otpd processes the malicious response, triggers the off-by-one write, and most likely crashes, disrupting OTP and IdP-based authentication for all users until the daemon restarts. No public proof-of-concept exploit has been identified at time of analysis.