Description

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-22T13:17:11.170Z",
  "pubdate": "2026-09-22T13:17:11.170Z",
  "executiveSummary": "ManageEngine ADSelfService Plus versions prior to build 7001 contain a critical authentication bypass vulnerability within the REST API architecture.\nThis vulnerability permits unauthenticated remote attackers to circumvent standard identity verification protocols, effectively granting unauthorized access to the application interface.\nThe flaw stems from improper implementation of API endpoint security, which fails to adequately validate session tokens or identity assertions for specific REST requests.\nSuccessful exploitation allows an adversary to interact with the system without providing valid credentials, potentially leading to unauthorized data access, administrative manipulation of identity management configurations, or further system compromise.\nGiven the product's role as an identity and password management solution, the risk implications are severe, as it exposes the underlying directory service infrastructure to direct exploitation.\nAttackers do not require pre-existing authentication, making the vulnerability highly attractive for external threat actors targeting organizational network access.",
  "technicalDetails": "The vulnerability resides within the REST API framework utilized by ManageEngine ADSelfService Plus to facilitate programmatic interactions between the web server and the internal application logic. The root cause is a failure in the request processing pipeline to enforce authentication checks on specific API routes, allowing requests to be processed in an unauthenticated context.\nIn a standard deployment, the ADSelfService Plus REST API is intended to be protected by an authentication interceptor that verifies session cookies or authorization headers before dispatching the request to the target controller. However, the identified flaw indicates that certain endpoints bypass this security middleware entirely. By crafting specific HTTP requests to these exposed endpoints, an attacker can trigger sensitive server-side logic that expects an established user context, despite the absence of valid credentials.\nThe exploitation flow begins with the reconnaissance of the REST API surface to identify the vulnerable URI patterns that do not trigger an immediate 401 Unauthorized or 403 Forbidden response. Once a targetable endpoint is identified, the attacker crafts a malicious request—typically involving standard HTTP verbs—designed to invoke backend functions related to password resets, user metadata retrieval, or administrative operations. Because the application logic fails to validate the request origin or session integrity, it processes the request as if it originated from a legitimately authenticated user.\nThis vulnerability is particularly dangerous because it exposes the core functional logic of the application to the network. An attacker can perform actions that should only be available to authenticated administrators or end-users, such as modifying sensitive account properties, initiating password reset workflows for arbitrary users, or extracting identity information from the connected Active Directory environment. The impact is essentially total compromise of the application's integrity within the ADSelfService Plus ecosystem.\nThe attack is characterized by low complexity as it does not require specialized tools beyond standard HTTP manipulation libraries or proxy tools like Burp Suite. Because the flaw exists within the API authentication handler, it allows an attacker to bypass multi-factor authentication (MFA) and other organizational security policies that are normally enforced at the authentication gateway, as these protections are bypassed before they can even evaluate the request context."
}