CVE-2026-18147
A flaw was found in FreeIPA.
Published Sep 9, 2026 · updated Oct 15, 2026 · Red Hat Red Hat Enterprise Linux 10
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
Timeline
Detection, updates, and resolution for this record.
Sep 9, 2026 · NIST NVD
Detected
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated
Oct 15, 2026 · NIST NVD
Updated
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated
Affected
- vendor Red Hat Red Hat Enterprise Linux 10version unspecified
- vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8version unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inj
vulnerability.circl.lu - CVE.orgCVE-2026-18147
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-18147
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inj
nvd.nist.gov