CVE-2026-14612
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer.
Risk Assessment
The risk for the organization includes limited denial of service (DoS) affecting the ipa-otpd daemon, potentially disrupting OAuth2 authentication services in the FreeIPA environment. Exploitation requires FreeIPA to be configured with an external IdP and a user to initiate the OAuth2 device authorization flow.
Recommendation
It is recommended to immediately update FreeIPA to a version containing the fix for the off-by-one errors in ipa-otpd. Until the update is applied, limit trust in external OAuth2/OIDC providers and monitor network traffic to identity provider endpoints.
Other vulnerabilities in FreeIPA
See all- CVE-2026-73199Medium
The ipa-enrollment SLAPI plugin in FreeIPA has a null pointer dereference vulnerability. A remote authenticated client can send a malformed LDAP extended operation, omitting the request value for JOIN_OID, causing a server crash and denial of service.
- CVE-2017-11191High
FreeIPA 4.x with API version 2.213 allows remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session.
- CVE-2015-5179High
FreeIPA might display user data improperly via vectors involving non-printable characters.
- CVE-2016-7030High
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts. This allows remote attackers to cause a denial of service by locking out the account in which system services run on.
- CVE-2016-5414High
FreeIPA version 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
- CVE-2026-11861Critical
A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.
- CVE-2025-4404Critical
A privilege escalation from host to domain vulnerability was found in FreeIPA. The lack of uniqueness validation for the `krbCanonicalName` attribute of the admin account allows creating a service with the same canonical name as the REALM admin. A successful attack lets the attacker obtain a Kerberos ticket with admin@REALM credentials.
- CVE-2015-5284Critical
In FreeIPA before version 4.2.2, the ipa-kra-install script places the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
- CVE-2026-73198High
A flaw in FreeIPA allows a remote unauthenticated attacker to exploit the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body, causing excessive memory consumption, memory exhaustion, and denial of service.
- CVE-2026-73197High
A flaw in FreeIPA allows a remote unauthenticated attacker to send oversized form POST requests to `/ipa/migration/migration.py`, forcing the migration handler to read attacker-controlled bodies fully into memory, leading to increased memory usage, slower handling, and potential DoS.
Original NVD description (English source)
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.