CVE-2026-18147CWE-79cross-site-scripting

CVE-2026-18147

High · published September 9, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-09T21:17Z
References (10)
https://access.redhat.com/errata/RHSA-2026:83460 · [email protected]https://access.redhat.com/errata/RHSA-2026:70564 · [email protected]https://access.redhat.com/errata/RHSA-2026:72279 · [email protected]https://access.redhat.com/errata/RHSA-2026:82935 · [email protected]https://access.redhat.com/errata/RHSA-2026:83083 · [email protected]https://access.redhat.com/errata/RHSA-2026:83084 · [email protected]https://access.redhat.com/errata/RHSA-2026:83085 · [email protected]https://access.redhat.com/errata/RHSA-2026:83461 · [email protected]https://access.redhat.com/security/cve/CVE-2026-18147 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2508181 · [email protected]
EPSS history
Timeline
  • 11 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 09 SEP 16:39Z
    Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
    cvelistv5