A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web… (CVE-2026-18147)

CVE-2026-18147 is a DOM XSS vulnerability in the FreeIPA/IdM Web UI password reset page. It allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript code by enticing a victim to click a specially crafted link and complete a password reset process. This enables the attacker to perform actions within the victim's authenticated session, which could lead to full administrative control if the victim is an IdM administrator. Red Hat's advisory (RHSA-2026:70564) includes a security update that fixes this issue along with other FreeIPA vulnerabilities.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session, enabling actions with the victim's privileges. If the victim is an IdM administrator, the attacker could gain full administrative control over the FreeIPA/IdM environment. This poses a high confidentiality and integrity risk but does not impact availability.

Red Hat has released an official security update for FreeIPA in Red Hat Enterprise Linux 9 that addresses this vulnerability. Users should apply the update as provided in RHSA-2026:70564 to remediate the issue. No additional mitigation steps are required beyond applying the official patch.