A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-commonUpgrade python3-ipaclientUpgrade ipa-commonUpgrade python3-ipaserverUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade ipa-client-sambaUpgrade ipa-client-encrypted-dnsUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade ipa-selinux-nfastUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade ipa-selinuxUpgrade python3-ipatestsUpgrade ipa-selinux-luna | Oct 11, 2026 | Sep 23, 2026 |
| Redhat_linux | — | Upgrade bind-dyndb-ldapUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade ipa-server-debuginfoUpgrade ipa-server-encrypted-dnsUpgrade python3-kdcproxyUpgrade softhsmUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade custodiaUpgrade ipa-debugsourceUpgrade softhsm-develUpgrade softhsm-debugsourceUpgrade opendnssecUpgrade ipa-healthcheck-coreUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade python3-ipalibUpgrade ipa-client-debuginfoUpgrade python3-qrcodeNo solution existsUpgrade ipa-client-commonUpgrade ipa-selinux-nfastUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade slapi-nisUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-selinuxUpgrade ipa-commonUpgrade ipa-client-epnUpgrade python3-yubicoUpgrade ipa-selinux-lunaUpgrade ipa-serverUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade ipa-healthcheckUpgrade python3-ipaserverUpgrade ipa-clientUpgrade softhsm-debuginfoUpgrade python3-ipatestsUpgrade ipa-client-sambaUpgrade python3-jwcryptoUpgrade python3-ipaclientUpgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsource | Sep 11, 2026 | Sep 9, 2026 |
| Rocky_linux | — | Upgrade ipa-server-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-debugsourceUpgrade ipa-client-epnUpgrade ipa-server-trust-adUpgrade ipa-client-encrypted-dnsUpgrade ipa-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-client-sambaUpgrade ipa-server-encrypted-dns | Sep 28, 2026 | Sep 24, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub