FreeIPA EUVD-2026-63241

Exploitation requires a valid low-privilege FreeIPA domain account (confirmed by PR:L in the CVSS vector) and network connectivity to the IPA service endpoint (AV:N). The oversized OTP key must be submitted through the FreeIPA OTP enrollment or validation interface, meaning OTP functionality must be reachable by the attacker's account - this is available by default in standard FreeIPA deployments. Unauthenticated attackers cannot trigger the flaw; at minimum, one valid domain credential is required. There is no requirement for administrative privileges, special group membership, or non-default configuration - any authenticated domain user with access to the OTP path is sufficient. The limiting factors are: (1) possession of at least one valid domain credential, and (2) network-level access to the IPA service ports.

The CVSS 4.3 score and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L are internally consistent with the described behavior: network-reachable, low complexity, low-privilege, with only partial availability impact and no confidentiality or integrity consequences. No EPSS score was included in the intelligence package, precluding probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, indicating no confirmed active or widespread exploitation at time of analysis. The real-world risk is primarily an insider threat or post-credential-compromise scenario: an attacker who has obtained any valid domain account - through phishing, password spray, or credential theft - can repeatedly trigger resource exhaustion to disrupt authentication for all systems relying on FreeIPA. In large enterprise environments where FreeIPA is the sole authentication backbone, sustained triggering could cascade into a broader service outage. The low A:L impact rating suggests partial rather than total service loss per event, but the low attack complexity means the condition is trivially repeatable. This is not a high-severity vulnerability in isolation but warrants patching promptly in environments with many low-trust users or where FreeIPA is a single point of failure for authentication.

An attacker who holds any valid FreeIPA domain credential - obtained via phishing or password spray - connects to the IPA service over HTTPS and submits a crafted request containing an abnormally large OTP key value. The IPA service accepts the input and begins an unbounded decode/re-encode operation, consuming server CPU and memory. The attacker repeats the request in a loop, sustaining resource pressure until the IPA daemon becomes unresponsive, causing authentication failures for all users and services dependent on the FreeIPA instance.