EUVD-2026-41554
GHSA-fr6j-mfcv-pgmf
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
MITM or IdP-control prerequisite drives AC:H; user-initiated flow requires UI:R; no privileges needed on FreeIPA system itself (PR:N); one-byte write supports I:L conservatively, daemon crash supports A:L.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.
AnalysisAI
Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability exists in the ipa-otpd daemon's handler for the OAuth2 device authorization flow (RFC 8628), which FreeIPA uses to integrate with external OAuth2/OIDC Identity Providers for multi-factor authentication. Two off-by-one fencepost errors (CWE-787, Out-of-bounds Write) in the response-parsing logic fail to correctly bound a fixed-size buffer when the IdP returns an oversized payload, permitting reads or writes of exactly one byte beyond the buffer's end. Affected products are confirmed via CPE as FreeIPA shipped within Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*). The root cause class CWE-787 typically arises from length-minus-one calculation errors and can produce memory corruption or process crashes depending on what data occupies the adjacent byte.
RemediationAI
Apply the Red Hat-released errata for ipa-otpd once available via standard RHEL subscription channels; consult https://access.redhat.com/security/cve/CVE-2026-14612 for the specific advisory and updated package version, which was not confirmed in the available data at time of analysis. As an immediate compensating control, administrators should assess whether external IdP integration for the device authorization flow is actively required; if not, removing the external IdP configuration from FreeIPA (using 'ipa idp-del' or clearing IdP references from user accounts) eliminates the attack surface entirely - the trade-off is loss of OAuth2/OIDC SSO capability for affected users. For environments that must retain external IdP integration, restricting the network path between ipa-otpd and the IdP endpoint to a trusted, TLS-authenticated channel with certificate pinning mitigates the MITM prerequisite. No exact fix version was independently confirmed from the available data.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today