Executive brief
FreeIPA is an open-source identity management system used to manage users, groups, and authentication across enterprise networks. An authenticated user can trigger a denial-of-service condition by submitting an unusually large One-Time Password (OTP) key value, which causes the system to consume excessive CPU and memory resources without proper limits. This degradation of the IPA service can disrupt authentication and identity management operations for legitimate users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in FreeIPA's OTP token handling, specifically in the `otptoken-add` endpoint. An authenticated low-privilege user can submit an oversized OTP key value that bypasses size validation checks during decoding and re-encoding operations, consuming unbounded CPU and memory resources. The attack is network-accessible and requires only low-privilege authentication and no user interaction. The vulnerable component lacks proper resource throttling during parameter conversion on the `/ipa/session/json` endpoint. Patches are expected; mitigation can be achieved by enforcing conservative HTTP request-body size limits at the web server level or restricting OTP token creation to trusted users.
Affected products
- Red Hat FreeIPA
Timeline
- 2026-08-20: disclosed