A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slapi-nisUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade ipa-selinux-lunaUpgrade ipa-serverUpgrade ipa-selinuxUpgrade ipa-server-dnsUpgrade python3-custodiaUpgrade ipa-healthcheck-coreUpgrade softhsm-develUpgrade ipa-client-epnUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade ipa-selinux-nfastUpgrade ipa-clientUpgrade python3-kdcproxyUpgrade custodiaUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-ipalibUpgrade python3-ipaclientUpgrade python3-qrcode-coreUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-client-encrypted-dnsUpgrade softhsmUpgrade opendnssecUpgrade bind-dyndb-ldapUpgrade ipa-commonUpgrade ipa-python-compatUpgrade ipa-server-encrypted-dnsUpgrade python3-ipaserverUpgrade python3-jwcrypto | Oct 11, 2026 | Sep 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-server-dnsUpgrade ipa-python-compatUpgrade ipa-server-trust-adUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-commonUpgrade python2-ipaserverUpgrade python2-ipaclient | Oct 19, 2026 | Oct 19, 2026 |
| Oracle_linux | — | Upgrade python3-ipalibUpgrade python3-qrcode-coreUpgrade custodiaUpgrade python3-pyusbUpgrade ipa-client-sambaUpgrade python3-jwcryptoUpgrade ipa-commonUpgrade opendnssecUpgrade ipa-server-encrypted-dnsUpgrade python3-ipatestsUpgrade python3-qrcodeUpgrade ipa-server-commonUpgrade python3-ipaclientUpgrade ipa-client-commonUpgrade bind-dyndb-ldapUpgrade python3-ipaserverUpgrade softhsmUpgrade ipa-serverUpgrade python3-custodiaUpgrade softhsm-develUpgrade ipa-clientUpgrade ipa-healthcheck-coreUpgrade ipa-server-trust-adUpgrade ipa-python-compatUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade ipa-selinux-nfastUpgrade ipa-selinux-lunaUpgrade python3-kdcproxyUpgrade python3-yubicoUpgrade ipa-client-encrypted-dnsUpgrade slapi-nisUpgrade ipa-healthcheck | Oct 22, 2026 | Sep 9, 2026 |
| Redhat_linux | — | Upgrade python3-kdcproxyUpgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade ipa-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-client-commonUpgrade opendnssecUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade ipa-healthcheck-coreUpgrade softhsmUpgrade python3-pyusbUpgrade ipa-server-trust-adUpgrade python3-qrcode-coreUpgrade ipa-server-encrypted-dnsUpgrade python3-ipalibUpgrade python3-qrcodeUpgrade ipa-server-debuginfoUpgrade python3-custodiaNo solution existsUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade bind-dyndb-ldapUpgrade ipa-python-compatUpgrade opendnssec-debugsourceUpgrade custodiaUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade python3-ipaclientUpgrade ipa-client-epnUpgrade slapi-nis-debuginfoUpgrade python3-ipatestsUpgrade python3-jwcryptoUpgrade slapi-nis-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinuxUpgrade slapi-nisUpgrade ipa-selinux-lunaUpgrade ipa-healthcheckUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-commonUpgrade ipa-server-trust-ad-debuginfoUpgrade opendnssec-debuginfoUpgrade ipa-clientUpgrade python3-ipaserverUpgrade softhsm-debuginfoUpgrade python3-yubico | Sep 11, 2026 | Sep 9, 2026 |
| Rocky_linux | — | Upgrade softhsm-debuginfoUpgrade ipa-server-debuginfoUpgrade slapi-nisUpgrade opendnssec-debuginfoUpgrade ipa-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-epnUpgrade ipa-server-trust-adUpgrade slapi-nis-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldapUpgrade softhsm-develUpgrade ipa-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade ipa-clientUpgrade opendnssecUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsmUpgrade ipa-client-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-serverUpgrade softhsm-debugsourceUpgrade ipa-client-sambaUpgrade ipa-server-encrypted-dns | Sep 28, 2026 | Sep 24, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub