CVE-2026-73644 in OpenDJ
Summary
by MITRE • 08/13/2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability identified in OpenDJ versions prior to 5.1.2 represents a critical authorization flaw within the SASL PLAIN authentication mechanism implementation. This weakness specifically affects the authorization identity path handling within the PlainSASLMechanismHandler class, where the system fails to properly validate proxy access controls when resolving authorization identities. The issue stems from an incomplete security check that only verifies the PROXIED_AUTH privilege without adequately assessing whether the target identity falls within the scope permitted by the proxy ACI configuration.
The technical flaw manifests when processing authentication requests using dn: or u: format authorization identifiers, or bare authzid forms that resolve to different user identities. During the authentication process, the system grants access to any resolvable non-root identity regardless of the proxy ACI restrictions that should normally limit such privileges. This creates a privilege escalation vector where authenticated users with the PROXIED_AUTH privilege can assume the identities of other users who are not explicitly permitted by their own proxy ACI scope. The vulnerability essentially bypasses the intended access control boundaries that should prevent unauthorized identity delegation.
The operational impact of this vulnerability extends beyond simple privilege escalation, potentially allowing attackers to gain unauthorized access to user accounts and sensitive directory information. When an authenticated user with PROXIED_AUTH privilege attempts to authenticate using a target authorization identity, the system incorrectly grants access without proper validation against the proxy ACI scope. This affects the fundamental security model of the directory service by undermining the principle of least privilege and potentially enabling lateral movement within the directory structure.
The fix implemented in OpenDJ version 5.1.2 addresses this vulnerability by introducing a critical validation check that returns INVALID_CREDENTIALS (49) error code before password verification occurs when the target authorization identity is not permitted. This approach ensures that the system rejects unauthorized delegation attempts at the earliest possible stage of the authentication process, preventing any further processing that could lead to privilege escalation. The solution aligns with security best practices by implementing fail-closed behavior rather than relying on permissive access controls.
This vulnerability maps directly to CWE-285 (Improper Authorization) and CWE-305 (Authentication Bypass Through User Identification) within the Common Weakness Enumeration framework, highlighting the fundamental flaw in authorization validation. From an ATT&CK perspective, this issue relates to T1078 (Valid Accounts) and T1566 (Phishing) as it enables attackers to leverage legitimate authentication credentials to assume unauthorized identities. The security implications are particularly severe given that LDAP directory services often contain sensitive user information, authentication data, and access control policies that form the foundation of enterprise security infrastructure.
Organizations using affected OpenDJ versions should immediately implement the patch to version 5.1.2 or higher to prevent potential exploitation. Additionally, administrators should review existing proxy ACI configurations to ensure proper scope limitations are in place and consider implementing additional monitoring for unusual authentication patterns involving authorization identity delegation. The vulnerability demonstrates the critical importance of comprehensive access control validation, particularly in systems where identity delegation is permitted, as incomplete implementation of such controls can lead to significant security breaches affecting entire directory service infrastructures.