Two off‑by‑one errors in the FreeIPA ipa‑otpd daemon’s OAuth2 device authorization handler can trigger an out‑of‑bounds memory access when the daemon processes an oversized response from a configured external OAuth2/OIDC Identity Provider. The overflow is a classic buffer overflow (CWE‑787) that allows an attacker to read or write a single byte past the end of a fixed‑size buffer, potentially crashing or causing a denial of service in the ipa‑otpd daemon. The most probable consequence is a limited denial of service that would disrupt the IPA device authorization service but does not expose application data or system privileges.

FreeIPA installations running on Red Hat Enterprise Linux 6 through 10 that are configured with an external identity provider are affected. The vulnerable component is the ipa‑otpd daemon within those operating systems; the issue relies on a statically configured IdP and incoming OAuth2 device authorization requests.

The vulnerability carries a CVSS score of 4.2, indicating moderate severity. The EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to control or intercept the external IdP endpoint and a user to initiate an OAuth2 device authorization flow, making the attack scenario moderately constrained. Given the limited impact and low likelihood, the overall risk is moderate, but monitoring for future patches is advised.