FreeIPA self-managed OTP token ACI allows unauthenticated LDAP clients to add unrestricted attributes to token entries; combined with a separate 389 Directory Server ACI-evaluation flaw, attackers can create an arbitrary Kerberos principal and add it to the administrators group. Affects RHEL 7/8/9/10 ipa/idm:client/ipa. Mitigate by restricting LDAP 389/636 and disabling anonymous binds.