Executive brief
FreeIPA is an open-source identity management solution used to manage users, policies, and trust relationships in Linux environments. A security flaw in its one-time password daemon (ipa-otpd) could allow an attacker who controls a linked identity provider to crash the service. This would prevent users from logging in using external identity providers, potentially disrupting business operations and authentication services.
Technical details
Two off-by-one vulnerabilities exist in the `ipa-otpd` daemon within `daemons/ipa-otpd/oauth2.c`. The first is an out-of-bounds write (CWE-787) where a null terminator is placed one byte past a fixed 10240-byte buffer when a response exactly matches the buffer size. The second is an out-of-bounds read (CWE-125) during `memchr` operations while parsing the response. An attacker must control or man-in-the-middle a configured external OAuth2/OIDC Identity Provider (IdP) and wait for a user to initiate a device authorization flow. Successful exploitation typically results in a denial of service (crash) of the `ipa-otpd` daemon.
Affected products
- FreeIPA FreeIPA
- Red Hat Enterprise Linux 7 affected
- Red Hat Enterprise Linux 8 affected
- Red Hat Enterprise Linux 9 affected
- Red Hat Enterprise Linux 10 affected
Timeline
- 2026-07-03: disclosed: Vulnerability reported and confirmed via Red Hat Bugzilla
- 2026-07-03: advisory: CVE-2026-14612 published by Red Hat