The write works because two defaults meet. FreeIPA decides who may log in across a Linux domain and keeps every identity in a 389 Directory Server database reached over LDAP [20]. It ships an access control rule, an ACI, that lets a user manage their own one-time-password token, and that rule neither requires the client to have logged in nor limits what else may be written alongside the token [4]. The directory server has a rule type meant to say "only the authenticated owner of this entry", and it compares the client's name against a stored value as plain text; a client that has not logged in has an empty name, and an empty name matches an empty stored value [5]. So the token entry goes in with the ownership fields left blank, the ownership check is passed by being nobody, and a Kerberos identity and password are written alongside it [6].
Red Hat says Red Hat Directory Server ships no rule of that shape by default, which is why CVE-2026-76560 on its own only bites deployments that wrote one [7]. FreeIPA's shipped rule is exactly that shape, and that is why an untouched install is exploitable; The Hacker News says the connection between the two halves is its own reading of advisories that describe them separately [8]. Red Hat also reproduced the directory-server defect on a plain 389-ds build with no FreeIPA parts installed, and a control test using a value that was not empty was correctly refused, which places the defect in the access-control engine [9].
On Red Hat systems the package is ipa, shipped as Identity Management [19]. The image Red Hat exercised was a stock FreeIPA container running 4.13.1, and it verified the outcome with standard administrator-only commands rather than trusting the exploit's output [14]. The collision fix landed in 4.13.3 [11] and the fix for the unauthenticated write in 4.13.4 [2], so the tested build sat three patch releases behind the version that closes the chain [1].
Where a deployment uses Windows-style security identifiers, Red Hat says the attacker can also obtain a Kerberos ticket containing authorization data, extending access to the server's HTTP and Dogtag services, Dogtag being FreeIPA's built-in certificate authority [16].
The projects part company on the finish. Red Hat calls it genuine administrator-group membership and reusable administrator credentials [12]. The FreeIPA project puts it narrowly: the injected identity must not already exist, the CVE-2026-13097 fix prevents existing accounts from being taken over, and the attack "may be used as a stepping stone" to administrative privileges [13]. Red Hat's own framing of the sequence is that the attack now runs under a name the attacker picks, "reaching the same practical outcome" as the admin impersonation that was patched [10].
The other advisory disclosed alongside it is a smaller item. CVE-2026-79678, rated important at 8.1, passes a caller-supplied organization name and base URL into a Python eval() inside idp-add, and that call runs before the permission check meant to restrict the command to identity-provider administrators, so any account on the server can reach it whatever its privileges [17]. The call is limited by a pattern that forbids brackets, which stops any function being called [18]. That is an authorization bug with a filter holding the line, and it belongs behind the pre-authentication write.
