Riskcovery

CVE-2026-73644

OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant

State
Published
Severity
9.6 Critical
Published
Aug 13, 2026
Updated
Aug 18, 2026
Reserved
Aug 13, 2026

Read the record on cve.org

Description

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

Scores

CVSSScoreVectorSource
3.19.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NGitHub_M

Weaknesses

  • CWE-285 Improper Authorization
  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
OpenDJOpenIdentityPlatform
  • < 5.1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.