FreeIPA 4.13.5

FreeIPA 4.13.5#

The FreeIPA team would like to announce FreeIPA 4.13.5 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.13.5#

  • CVE-2026-53683: Client-side open redirect in reset_password.html

reset_password.html page parses query string parameters and uses url as a redirection target (window.location = url) after password reset, optionally delayed by delay. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the workflow.

An attacker must entice a victim to use the crafted reset URL (not hard, as the URL domain appears legitimate). No attacker authentication is required. The redirect can be used for phishing and user-trust abuse (appearing to originate from IdM), and can assist chaining with other social engineering or browser attacks by moving users from a trusted IdM origin to an attacker-controlled site at a sensitive moment. Ultimately, the attacker can get a user to visit a malicious URL while appearing legitimate.

  • CVE-2026-86593: Unauthenticated DoS in session endpoints (login_password, change_password, sync_token) via Unbounded Request Body Read

The public session endpoints login_password, change_password, and sync_token do not limit unauthenticated attacker from causing additional load on WSGI processes and may lead to denial of service situations. Because that worker pool is shared by the whole /ipa WSGI application, exhausting it denies all IPA HTTP functionality, including the GSSAPI/Kerberos-authenticated paths (WebUI, admin RPC), not only other unauthenticated requests.

This is a distinct instance of the same root-cause class already fixed for i18n_messages (CVE-2026-73198) and /ipa/migration/migration.py (CVE-2026-73197); the fix for CVE-2026-73198 was scoped only to a single caller and left this defect present in the three session endpoints.

Enhancements#

Known Issues#

Bug fixes#

FreeIPA 4.13.5 is a stabilization release for the features delivered as a part of 4.13 version series. Details of the bug-fixes can be seen in the list of resolved tickets below.

Upgrading#

Upgrade instructions are available on Upgrade page.

Feedback#

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat.

Resolved tickets#

Detailed changelog since 4.13.4#

Antonio Torres (1)#

Carla Martinez (1)#

  • CVE-2026-86593: Limit request body size on unauthenticated session endpoints commit

David Hanina (1)#

  • webui: remove redirect from password reset page commit