CVE-2020-26168: 
NixOS vulnerability analysis and mitigation

The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, contained a vulnerability where the system didn't properly verify passwords in certain system-user-dn scenarios. This authentication bypass vulnerability was discovered and disclosed in November 2020 (Debian Tracker).

The vulnerability exists in the LDAP authentication implementation where the password verification process was flawed. Specifically, in certain system-user-dn scenarios, the LdapLoginModule failed to properly validate user passwords during the authentication process (Hazelcast Docs).

The vulnerability allowed users (clients/members) to be authenticated even when providing invalid passwords, effectively bypassing the authentication mechanism. This could potentially lead to unauthorized access to the Hazelcast cluster (Debian Tracker).

The vulnerability could be exploited by attempting to authenticate with invalid credentials in specific system-user-dn scenarios, potentially allowing unauthorized access to the system (Debian Tracker).

The vulnerability was addressed in Hazelcast IMDG Enterprise version 4.0.3. Users running affected versions should upgrade to version 4.0.3 or later to resolve this security issue (Hazelcast Docs).