CyberRota Analysis
AI-GeneratedA critical vulnerability in FreeIPA allows unauthenticated LDAP clients to exploit a misconfigured self-managed OTP token ACI, enabling attackers to create arbitrary Kerberos principals and gain membership in the administrators group. This grants remote attackers the ability to perform administrative operations on the directory and potentially other Identity Management services in SID-enabled deployments. Organizations using FreeIPA should prioritize immediate remediation to prevent unauthorized access and potential compromise of their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.