CVE-2026-76578

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.13.4

Description A flaw exists in the self-managed OTP token Access Control Instruction (ACI), which does not require authentication and fails to restrict the attributes that can be added alongside a token entry. An unauthenticated LDAP client can exploit this issue, in conjunction with a separate flaw in the underlying directory server's ACI evaluation, to create an attacker-controlled Kerberos principal and add it to the administrators group. This allows a remote, unauthenticated attacker to gain full administrator-group membership and perform administrative operations against the directory and other Identity Management (IdM) services on SID-enabled deployments.

Recommendations Update to version 4.13.4.