CVE-2026-18147: Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
Affected Software
Event History
Frequently Asked Questions
Who is most at risk from this issue?
Users who can be tricked into opening a crafted link and completing a password reset in the FreeIPA/IdM Web UI are exposed. The impact is greatest when the targeted user is an IdM administrator, because code executing in that authenticated session could potentially result in full administrative control.
What does an attacker need to exploit the vulnerability?
The attacker does not need to authenticate, and exploitation is described as low complexity. They must entice a victim to click a specially crafted URL and complete the password-reset process.
Does exploitation require any interaction from the victim?
Yes. The victim must click the attacker-controlled link and complete a password reset; the issue is not described as exploitable without user interaction.