CVE-2026-73644: 
Java vulnerability analysis and mitigation

CVE-2026-73644 is a SASL PLAIN authorization identity (authzid) bypass vulnerability in OpenDJ, an LDAPv3-compliant directory service by OpenIdentityPlatform. The flaw allows an authenticated account holding the PROXIED_AUTH privilege to impersonate any resolvable non-root directory identity without being constrained by the deployment's proxy ACI (Access Control Instruction) scope. All versions prior to 5.1.2 are affected. The vulnerability was disclosed on July 23, 2026 via a GitHub Security Advisory and carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory).

The root cause is improper authorization (CWE-285) combined with authorization bypass through a user-controlled key (CWE-639). The vulnerable code resides in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java, where the SASL PLAIN bind handler verified only the PROXIED_AUTH privilege but never invoked the mayProxy ACI scope check when an authzid resolved to a different user. This diverged from all other proxy paths in OpenDJ (proxied-authorization controls per RFC 4370, DIGEST-MD5, and GSSAPI), which require both the privilege and an explicit proxy ACI grant. Both dn: and u: (or bare) authzid forms were exploitable. The fix, applied in commit 5c326850, introduces a shared checkProxyAccess / hasProxyAccess helper that enforces the mayProxy ACI scope check on the SASL PLAIN path and returns INVALID_CREDENTIALS (result code 49) before password verification when the target identity is not permitted (GitHub Advisory, Fix Commit).

Successful exploitation enables privilege escalation and authorization bypass: an attacker with a low-privileged account that holds the PROXIED_AUTH privilege can assume the identity of any resolvable non-root directory user, regardless of the proxy ACIs configured by the administrator. This grants the attacker full read and write access to directory data belonging to impersonated users, potentially exposing sensitive identity information (credentials, personal data, group memberships) and allowing unauthorized modifications to directory entries. The scope is changed, meaning the impact extends beyond the attacker's own account to other users' data across the directory. Root/Directory Manager identities are not assumable via this path (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires the attacker to already hold a valid account with the PROXIED_AUTH privilege, making it a low-privilege (not unauthenticated) attack. The EPSS score is approximately 0.0029 (0.29%), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment notes exploitation as "none" (GitHub Advisory, Feedly).

1. Reconnaissance: Identify OpenDJ instances running versions prior to 5.1.2 exposed on the network (default LDAP port 389 or LDAPS port 636). Confirm the server version via an anonymous rootDSE query (ldapsearch -h <target> -p 389 -b "" -s base "(objectClass=*)" vendorVersion).
2. Obtain a PROXIED_AUTH account: Acquire credentials for any directory account that has been granted the ds-privilege-name: proxied-auth attribute. This may be a service account or a compromised low-privileged user.
3. Identify target identity: Enumerate directory users to find a target identity (e.g., a high-privileged user's DN or uid) that the attacker wishes to impersonate. Root/Directory Manager is not a valid target.
4. Craft SASL PLAIN bind with authzid: Send an LDAP SASL PLAIN bind request using the attacker's credentials as authid and the target user's identity as authzid, using either dn: or u: syntax. Example using ldapsearch:

   ldapsearch --noPropertiesFile -h <target> -p 389 \
     -o mech=PLAIN \
     -o authid=dn:cn=Proxy Only User,o=example \
     -o authzid=dn:cn=High Privileged User,o=example \
     -w <attacker_password> \
     -b "o=example" -s sub "(objectClass=*)"

5. Achieve impersonation: On unpatched servers, the bind succeeds and all subsequent LDAP operations are performed as the target identity, granting access to that user's data and permissions (GitHub Advisory, Fix Commit).

• Network: LDAP SASL PLAIN bind requests (port 389/636) where the authid and authzid fields differ, particularly from accounts not expected to perform proxy operations; repeated bind attempts from a single source IP using different authzid values.
• Logs: OpenDJ access logs showing successful SASL PLAIN binds with mismatched authentication DN and authorization DN (look for authzDN differing from authDN in bind operation log entries); absence of expected INVALID_CREDENTIALS (result code 49) responses for accounts lacking proxy ACIs on unpatched servers.
• Directory: Unexpected read or write operations on sensitive directory entries attributed to high-privileged users, especially if those users are not actively logged in; modifications to user entries (passwords, group memberships, attributes) that cannot be correlated with legitimate administrative sessions.
• Process/Configuration: Accounts with ds-privilege-name: proxied-auth performing directory searches or modifications outside their normal operational scope (GitHub Advisory).

Upgrade OpenDJ to version 5.1.2 or later, which enforces the mayProxy ACI scope check on the SASL PLAIN authzid path (OpenDJ Release 5.1.2). As an immediate workaround prior to upgrading, restrict or revoke the proxied-auth privilege (ds-privilege-name: proxied-auth) from all accounts that do not strictly require it, reducing the attack surface to zero if no accounts hold the privilege (GitHub Advisory). Additionally, audit existing proxy ACI configurations to ensure they follow the principle of least privilege, and monitor LDAP access logs for anomalous SASL PLAIN binds with differing authid and authzid values.

The vulnerability was reported by security researcher hypnguyen1209 and credited in the GitHub Security Advisory. The fix was developed by 3A Systems, LLC and merged by the OpenDJ maintainer vharseko. No significant broader media coverage or notable public researcher commentary beyond the advisory and release notes has been identified at this time (GitHub Advisory, OpenDJ Release 5.1.2).