Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-03T14:00:00 freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during OAuth2 device authorization 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L CWE-787

Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.

Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.

Red Hat rates this issue as Low impact. Although the flaw is reachable over the network once an external IdP is configured, exploitation is not straightforward: a successful attack would require an attacker to control, or be able to man-in-the-middle, the configured IdP endpoint and to supply an oversized device authorization response while a domain user is starting that OAuth2 login flow. We have not identified a path to arbitrary code execution, privilege escalation, or disclosure of Kerberos keys or other IdM secrets. The practical outcome is limited to instability or crash of the ipa-otpd service handling that authentication attempt. Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Fix deferred ipa Red Hat Enterprise Linux 6 Out of support scope ipa Red Hat Enterprise Linux 7 Fix deferred ipa Red Hat Enterprise Linux 8 Fix deferred idm:client/ipa Red Hat Enterprise Linux 8 Fix deferred idm:DL1/ipa Red Hat Enterprise Linux 9 Fix deferred ipa https://www.cve.org/CVERecord?id=CVE-2026-14612 https://nvd.nist.gov/vuln/detail/CVE-2026-14612