Description

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-13T18:18:20.093Z",
  "pubdate": "2026-08-13T18:18:20.093Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the LDAPv3 compliant directory service OpenDJ prior to version 5.1.2. The vulnerability resides within the SASL PLAIN mechanism handler, specifically in the file opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java. When processing a SASL PLAIN bind request where an authorization identity (authzid) resolves to a different user, the application checks for the presence of the PROXIED_AUTH privilege but fails to evaluate the required mayProxy proxy ACI scope.\nThis security flaw allows an authenticated user holding the PROXIED_AUTH privilege to successfully assume any resolvable non-root user identity, bypassing strict access control restrictions enforced by proxy ACIs. Attackers can leverage both dn: and u: or bare authzid formats to execute unauthorized actions under the context of arbitrary target identities. The risk implications include unauthorized data access, privilege escalation, and violation of principle of least privilege within the directory service environment.\nExploitation requires network access to the OpenDJ directory service, valid initial authentication credentials, and the possession of the PROXIED_AUTH privilege. Remediation requires upgrading the affected OpenDJ deployment to version 5.1.2 or later, where the authorization validation logic has been corrected to properly enforce proxy ACI constraints prior to credential verification.",
  "technicalDetails": "The vulnerability is rooted in insufficient authorization checks within the SASL PLAIN authentication and authorization pipeline of OpenDJ. The vulnerable component is located in the opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java file, which manages SASL PLAIN mechanism handshakes and authorization identity mapping prior to version 5.1.2.\nThe root cause stems from a logic flaw in how the mechanism processes proxied authorizations. When a client initiates an LDAPv3 SASL PLAIN bind containing a specific authorization identity (authzid) that resolves to a user distinct from the authenticated entity, the implementation validates whether the actor possesses the PROXIED_AUTH privilege. However, the codebase omitted the evaluation of the mayProxy proxy Access Control Instruction (ACI) scope during this verification phase.\nAttackers can exploit this deficiency by crafting SASL PLAIN bind requests utilizing various authzid formats, including dn:, u:, or bare authorization identity strings. Because the mayProxy scope is bypassed, an authenticated account equipped with the PROXIED_AUTH privilege can supply a target authzid corresponding to any resolvable non-root identity. The server erroneously permits the session context to map to the target identity even if the proxy ACI explicitly prohibits the specific mapping.\nThe attack flow proceeds as follows: 1. The client establishes a network connection to the OpenDJ server using LDAPv3 protocols. 2. The client initiates a SASL PLAIN bind request, supplying credentials for an authenticated account that holds the PROXIED_AUTH privilege alongside an arbitrary target authorization identity via dn:, u:, or bare authzid syntax. 3. The vulnerable PlainSASLMechanismHandler processes the request, verifies the presence of the PROXIED_AUTH privilege, but fails to query or evaluate the mayProxy proxy ACI scope. 4. The server accepts the mapping without validating whether the source user is authorized to proxy as the target user. 5. The server performs password verification and establishes the session under the context of the requested target identity, granting unauthorized access to directory data and resources outside the boundaries permitted by the configured proxy ACI.\nThe affected versions comprise all OpenDJ releases prior to version 5.1.2. The vulnerability can be exploited over the network by any authenticated user who possesses the PROXIED_AUTH privilege. Post-exploitation impact includes unauthorized data disclosure, administrative privilege escalation, and integrity violations across the directory tree, restricted only by the exclusion of root identities."
}