CVE-2026-18922 in Directory Server
Summary
by MITRE • 09/07/2026
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in 389 Directory Server represents a critical authentication bypass flaw rooted in improper state management within the Simple Authentication and Security Layer implementation. Specifically, during SASL PLAIN authentication processes, the server fails to properly clear or isolate auxiliary properties associated with Cyrus SASL when transitioning between different bind attempts on the same network connection. This architectural oversight allows stale identity data from a previous failed authentication attempt to persist in memory and be erroneously applied to subsequent operations performed over that identical session channel. The core technical flaw lies in the failure of the server's security context initialization routine to reset or validate the source of identity attributes before accepting new credentials, thereby creating a window where legacy state can override current authentication outcomes regardless of the mechanism used for the succeeding bind operation.
The operational impact of this vulnerability is severe, as it enables an attacker to escalate privileges from unauthenticated access to full administrative control without possessing valid credentials for high-privilege accounts. By exploiting this race condition in session handling, a malicious actor can first initiate a SASL PLAIN bind using the distinguished name cn=Directory Manager along with an incorrect password, which triggers the storage of that identity in a stale auxiliary property due to the authentication failure. Subsequently, the attacker performs a second bind on the same connection using either the SASL ANONYMOUS mechanism or by authenticating as any other low-privileged user who has successfully logged in. In both scenarios, the server incorrectly associates the previously stored Directory Manager identity with the new session context, effectively granting the attacker full administrative authority equivalent to cn=Directory Manager despite lacking the corresponding password for that account.
This behavior aligns closely with CWE-287 Improper Authentication and CWE-613 Insufficient Session Expiration, as it involves a failure to properly manage session state and identity verification across multiple authentication events within a single connection lifecycle. From an offensive security perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1078 Valid Accounts, specifically illustrating how attackers can leverage existing valid sessions or anonymous access vectors to impersonate privileged entities through logic flaws rather than cryptographic breaks. The variant involving low-privileged accounts further expands the attack surface by allowing exploitation even when strict password policies are in place for administrative users, as long as any authenticated session exists on the same TCP connection.
Mitigation strategies must focus on immediate patching of the 389 Directory Server software to versions that address this state management defect. Administrators should ensure that all directory servers are updated with the latest security patches provided by Red Hat or upstream maintainers, which typically involve hardening the SASL layer to explicitly clear auxiliary properties upon any authentication failure and ensuring strict isolation between bind contexts on shared connections. Additionally, network-level controls such as connection timeouts and rate limiting can help reduce the window of opportunity for attackers to execute multi-step binding sequences within a single session. Regular auditing of directory server logs for unusual patterns of failed followed by successful binds from identical source IPs may also aid in early detection of exploitation attempts while patching efforts are underway.