CVE-2026-18147

CVE-2026-18147 is a DOM-based cross-site scripting flaw (CWE-79) in the password reset page of the FreeIPA/Identity Management (IdM) web UI, exploitable by an unauthenticated remote attacker. The attacker triggers it by luring a victim to click a specially crafted link and having the victim complete the password reset flow, at which point attacker-supplied JavaScript executes in the victim's browser. The injected code runs within the victim's authenticated session, letting the attacker perform actions as that user, and could lead to full administrative control of the IdM domain if the victim is an IdM administrator - reflected in the high CVSS 3.1 score of 8.1 (high confidentiality and integrity impact). Any organization running FreeIPA or Red Hat IdM whose users access the web UI password reset page is potentially affected; fixed version information is not included in the available data. There is no evidence of exploitation to date: the flaw is not in CISA KEV, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Apply the FreeIPA upstream and Red Hat IdM security updates referenced in vendor advisories once released, since fixed package versions are not given in the provided data. Until patching, caution users against clicking unsolicited password-reset links, verify the Web UI URL before completing any reset, and restrict Web UI access to trusted networks or VPN. Administrators should also check whether any FreeIPA/IdM web UI instances are reachable by untrusted parties and monitor Red Hat advisories for the patched versions.