Privilege escalation via unchecked PAC certificates

Authentication bypass in FreeIPA allows remote authenticated users to access FreeIPA services via TGS client-name impersonation in AD trusts. FreeIPA services that accept trusted Active Directory Kerberos tickets do not verify Privilege Attribute Certificate certificates, allowing an attacker to present a Ticket Granting Service ticket whose client name impersonates another principal. Exploitation requires a configured FreeIPA-Active Directory trust and an authenticated AD account; Red Hat states the attack is further constrained by the need to register a duplicate or conflicting Service Principal Name in the Active Directory forest, but successful abuse can grant portal, SMB, LDAP, and other GSSAPI-backed access in the FreeIPA domain.