CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

This is an Important flaw in the FreeIPA/IdM Web UI password reset page, allowing an unauthenticated remote attacker to execute arbitrary JavaScript. Exploitation requires a victim to click a crafted link and complete the password reset, potentially leading to full IdM administrative compromise if an administrator is targeted. This poses a significant risk to identity management infrastructure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the FreeIPA/IdM Web UI to trusted networks only. This can be achieved by configuring firewall rules to limit access to the IdM server's web interface (typically port 443 for HTTPS) from specific IP addresses or subnets. For example, using firewalld on RHEL, you can add a rich rule to allow access only from trusted sources. Ensure that any firewall changes are persistent across reboots and that the firewall service is reloaded or restarted for changes to take effect, which may temporarily disrupt access to the IdM Web UI.