CVE-2026-73196: 
NixOS vulnerability analysis and mitigation

CVE-2026-73196 is an authenticated denial-of-service vulnerability in FreeIPA (Red Hat IPA) caused by unbounded OTP key decoding and re-encoding in the otptoken-add command. A low-privilege authenticated user can submit an oversized ipatokenotpkey value to the IPA RPC interface, triggering excessive CPU and memory consumption in the API worker. The vulnerability was reported on May 11, 2026, and publicly disclosed on August 20, 2026. Affected versions include at least ipa-4.13.1-3.el10; specific fixed versions have not yet been released as of disclosure. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in ipaserver/plugins/otptoken.py. The OTPTokenKey._convert_scalar() method Base32-decodes attacker-supplied ipatokenotpkey input without enforcing any size limit, and otptoken_add.pre_callback() subsequently Base32-encodes the decoded bytes, URL-encodes the result, and constructs an otpauth:// enrollment URI — all without bounds checking. An attacker authenticates to the IPA RPC interface, crafts a JSON-RPC otptoken_add request with a very large valid Base32 string (e.g., ~32 MiB of repeated A characters) as the ipatokenotpkey value, and POSTs it to /ipa/session/json. By default, the ACI Users can create self-managed tokens grants ordinary authenticated users access to this code path, requiring only low privileges and no user interaction (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation degrades the availability of the FreeIPA/IPA service by consuming excessive CPU and memory in the API worker process handling the request. Repeated or parallelized requests can amplify the impact, potentially causing sustained service degradation for all users relying on the IPA authentication and identity management infrastructure. There is no confidentiality or integrity impact; the vulnerability is strictly an availability concern scoped to the IPA service itself (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid low-privilege authenticated account with self-managed token creation rights, which is a default permission in standard FreeIPA deployments, making the attack accessible to any authenticated user in affected environments (Red Hat Bugzilla, GitHub Advisory).

1. Authenticate: Obtain valid low-privilege credentials for the target FreeIPA deployment. Any user with default self-managed token creation rights (granted by the default ACI Users can create self-managed tokens) is sufficient.
2. Establish a session: Authenticate to the IPA RPC interface at /ipa/session/login_password to obtain a session cookie.
3. Craft the malicious request: Construct a JSON-RPC otptoken_add request with type set to totp and ipatokenotpkey set to a very large valid Base32 string (e.g., approximately 32 MiB of repeated A characters).
4. Submit the payload: POST the crafted request to /ipa/session/json with Content-Type: application/json and the authenticated session cookie.
5. Observe resource exhaustion: Monitor the IPA API worker for CPU and memory spikes during Base32 decode, Base32 re-encode, URL encoding, and otpauth:// URI construction.
6. Amplify the impact: Repeat or parallelize the request to sustain or increase service degradation for all IPA users (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (multi-megabyte bodies) to /ipa/session/json from authenticated sessions; repeated or parallelized large requests from the same source IP.
• Logs: IPA API access logs showing otptoken_add calls with abnormally large ipatokenotpkey parameter values; HTTP 413 or timeout errors if request-size limits are in place.
• Process: Sustained high CPU and memory utilization in the IPA API worker process (ipaserver/httpd) coinciding with authenticated RPC requests; worker process slowdowns or restarts.
• Application: Repeated otptoken_add operations from low-privilege accounts, especially in rapid succession or from multiple concurrent sessions (Red Hat Bugzilla, Red Hat CVE).

No released package fix is available as of the disclosure date. Red Hat recommends the following interim mitigations: enforce conservative HTTP request-body size limits on the /ipa/session/json endpoint to reject oversized payloads before they reach the vulnerable IPA parameter conversion code; restrict self-managed token creation to trusted users by modifying the relevant ACI if operationally feasible; and implement monitoring or rate-limiting for repeated large authenticated requests. A proposed code fix involves adding MAX_OTPKEY_BYTES = 1024 and MAX_OTPKEY_B32_CHARS bounds checks in OTPTokenKey._convert_scalar() and setting maxlength=MAX_OTPKEY_BYTES on the ipatokenotpkey parameter in ipaserver/plugins/otptoken.py (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process. Red Hat classified the flaw as Medium severity (CVSS 4.3) and published an advisory with interim mitigations. No significant broader community commentary or media coverage has been identified as of the disclosure date (Red Hat CVE, Red Hat Bugzilla).