EUVD-2026-75108
GHSA-8gwp-8p3v-22jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify IdM administrator email/identity
-
DeliveryCraft malicious password reset URL with XSS payload
-
ExploitDeliver link via phishing
-
InstallVictim clicks link and completes password reset
-
C2Injected JavaScript executes in authenticated session
-
ExecuteAttacker issues privileged IdM API calls
-
ImpactFull directory compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must click a specially crafted link to the FreeIPA/IdM Web UI password reset page AND complete the password reset interaction in their browser - passive browsing or merely opening the link is insufficient. The attacker requires no authentication (PR:N). The attack complexity is low (AC:L): no race condition, special timing, or configuration prerequisite beyond the Web UI being reachable. Maximum impact requires the victim to be an IdM administrator with an active authenticated session or sufficient privileges to perform privileged operations post-login. The password reset page must be reachable from the attacker's delivery vector (typically the public internet or intranet). Exploitation is limited by the mandatory two-step user interaction (click link + complete reset), making mass automated exploitation infeasible and requiring targeted social engineering. |
| Impact | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) accurately captures the attack profile: unauthenticated, network-reachable, low complexity, but dependent on a victim completing a multi-step interaction (clicking link and finishing a password reset). The C:H/I:H scores are justified because session hijacking of an IdM administrator grants full directory and policy control. The S:U designation is technically correct for the web component scope, though in practice full IdM compromise has downstream impact on all Kerberos/LDAP-integrated systems in the domain. No CISA KEV listing and no public POC have been identified, which meaningfully reduces the urgency compared to a raw score of 8.1 alone. EPSS data was not provided. The attack is not automatable due to the mandatory UI:R step requiring phishing or watering-hole delivery. Real-world risk is elevated specifically for environments where IdM administrators access the Web UI from internet-facing or phishable networks. |
| Exploit ScenarioDerived | An attacker crafts a URL pointing to the FreeIPA Web UI password reset endpoint with a malicious JavaScript payload embedded in a URL parameter that the DOM reflects unsanitized. The attacker sends this link via a phishing email to a known IdM administrator, framing it as a routine security notification. When the administrator clicks the link and completes the password reset form, the payload executes in the administrator's authenticated browser session, exfiltrating session tokens or directly invoking IdM API calls to create a new administrative account under attacker control. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
RemediationAI
Apply the Red Hat-issued update for the ipa package on all affected RHEL versions as detailed in the advisory at https://access.redhat.com/security/cve/CVE-2026-18147. Exact patched package versions are not confirmed in available data - consult the Red Hat advisory and use 'yum update ipa' or equivalent to pull the latest errata. As a compensating control pending patching, restrict access to the FreeIPA/IdM Web UI (typically TCP 443) to internal trusted networks only via firewall rules, eliminating the external phishing vector; trade-off is reduced administrative flexibility for remote admins. Additionally, instruct all IdM administrators to treat unsolicited password reset links as suspicious and to initiate resets only from known-good bookmarks. If the Web UI cannot be network-restricted, consider disabling the self-service password reset page and routing password resets through a separate authenticated channel.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is Red Hat's integrated open-source identity, policy, and audit solution - the upstream project for Red Hat Identity Management (IdM) - providing centralized authentication, authorization, and account information by combining LDAP, Kerberos, DNS, and a web-based management UI. The vulnerability is a DOM XSS (CWE-79) in the client-side JavaScript of the password reset page: attacker-controlled input from the URL or request parameters is written directly to the DOM without adequate sanitization or encoding, allowing script injection. The flaw is client-side (DOM manipulation), meaning the malicious payload is processed in the victim's browser rather than reflected from the server, which can bypass some server-side output-encoding defenses. Affected CPEs span all major RHEL generations: cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-reachable web UI, no attacker auth needed, but victim must actively complete password reset; C:H/I:H reflects full IdM session control with no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
Executive ViewAI
A cross-site scripting vulnerability in FreeIPA/IdM's password reset page allows unauthenticated attackers to hijack authenticated user sessions through socially engineered malicious links. If an IdM administrator is targeted, the attacker gains full administrative control over the organization's identity and access management infrastructure-effectively granting access to all systems and data the organization manages.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable the password reset functionality if operationally acceptable; enforce multi-factor authentication on all administrative accounts; implement email-based URL filtering to block password reset links; deploy out-of-band confirmation (phone verification or ticket approval) for all password resets; restrict IdM web UI access to known IP ranges; enable real-time session anomaly detection focused on administrative accounts; implement mandatory re-authentication for sensitive operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB