A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

A critical vulnerability was discovered in FreeIPA where the self-managed OTP token Access Control Instruction (ACI) neither requires authentication nor restricts which attributes may be added alongside a token entry. An unauthenticated LDAP client can exploit this flaw, in combination with a related directory server ACI evaluation vulnerability, to create an attacker-controlled Kerberos principal and insert it into the FreeIPA administrators group. This grants the remote, unauthenticated attacker full FreeIPA administrator-group membership, enabling administrative operations against the directory. On SID-enabled deployments, the impact extends to other Identity Management (IdM) services. The flaw represents a severe authentication bypass leading to complete privilege escalation. It is tracked under CVE-2026-76578 and referenced in Red Hat security advisories and Bugzilla.