Skip to content

CVE-2014-7828

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers...

3.5 LowFix available

CVE-2014-7828 is a low vulnerability (CVSS 3.5) in Freeipa, published November 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in freeipa 4.0.5-1.

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Exploit likelihood

2.07%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: CVE-2014-7828
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: CVE-2014-7828
Updated: 2026-11-02

EUVDEUVD-2014-0020 No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: EUVD-2014-0020
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9qrx-mq2m-crfv No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers...

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: GHSA-9qrx-mq2m-crfv
Updated: 2026-11-02

OSV No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: CVE-2014-7828
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-7828 No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: DEBIAN-CVE-2014-7828
Updated: 2026-11-02

OSVPYSEC-2014-101 No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: PYSEC-2014-101
Updated: 2026-11-02

OSVPYSEC-2014-104 No score

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

Record: PYSEC-2014-104
Updated: 2026-11-02

Affected products

freeipa

Affected packages

Affected packages
Package	Affected	Fixed
`freeipa` Debian:12	before 4.0.5-1	4.0.5-1
`freeipa` Debian:13	before 4.0.5-1	4.0.5-1

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	affected, aliases	EUVD
2026-11-02	created	OSV
2026-11-02	created	OSV
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less