An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject a Kerberos principal and password. Combined with a canonical-principal mismatch and, on older releases, a password-expiration-bypass, this produces genuine, reusable FreeIPA administrator Kerberos credentials. On SID-enabled deployments, the anonymously-readable ipaNTSecurityIdentifier attribute lets the attacker also obtain a PAC-bearing TGT, extending access to HTTP/Dogtag.

Independently reproduced twice against a stock, unmodified freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install — most recently from a client with zero prior access (no ticket, no local presence, network reachability only). Verified beyond the PoC's own output via klist -f, ldapwhoami -Y GSSAPI (returned genuine admin DN), ldapcompare (confirmed cn=admins membership), and a real admin-only write/delete (ipa user-add / ipa user-del).

Reported by Gia Bui (Calif.io) via PSIRTSUPT-21812; see linked ticket for full technical writeup, reporter PoC, and reproduction logs.