CVE-2026-18147

Name of the Vulnerable Software and Affected Versions FreeIPA (affected versions not specified)

Description An unauthenticated remote attacker can exploit a DOM Cross-Site Scripting (XSS) flaw in the FreeIPA/IdM Web UI password reset page. By tricking a user into clicking a crafted link and completing a password reset, the attacker can inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, which could result in full administrative control if an IdM administrator is targeted. DOM XSS is a type of security vulnerability where the application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by writing the data back to the Document Object Model (DOM).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.