Executive brief
FreeIPA is an identity and access management system used to manage user authentication and authorization for enterprise networks. A DOM-based cross-site scripting (XSS) vulnerability in the password reset page allows an unauthenticated attacker to inject malicious JavaScript code by tricking users into clicking a specially crafted link. If an administrator is targeted, an attacker could gain full control of the system and compromise all managed identities and resources.
Technical details
A DOM-based XSS vulnerability exists in the FreeIPA/IdM Web UI password reset page that fails to properly sanitize user-supplied input in the URL. An unauthenticated attacker can craft a malicious URL containing JavaScript payload; when a victim clicks the link and completes the password reset flow, the injected script executes within the victim's authenticated session context. No authentication or special privileges are required to craft or distribute the malicious link. Successful exploitation allows arbitrary actions on behalf of the victim, including administrative account takeover if an IdM administrator is the target. Red Hat has released patches in RHSA-2026:70564.
Affected products
- Red Hat FreeIPA <UNKNOWN>
Timeline
- 2026-09-09: disclosed
- 2026-09-23: advisory