TI-2026-51728 Aliases CVE-2026-73644 GHSA-p279-2cqp-84jg

Improper authorization in OpenIdentityPlatform OpenDJ

MEDIUM 43CWE-285Published 2026-08-13 · Updated 2026-08-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00413 35th percentileScored 2026-11-07

Fix Fixed OpenDJ (OpenIdentityPlatform): 5.1.2org.openidentityplatform.opendj:opendj-server-legacy (Maven): 5.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenDJ	before 5.1.2	5.1.2	Patch available	CNA
—	org.openidentityplatform.opendj:opendj-server-legacy (Maven)	before 5.1.2	5.1.2	Patch available	GHSA-p279-2cqp-84jg

OpenDJ VendorOpenIdentityPlatform Affected before 5.1.2 Fixed in 5.1.2 Patch available CNA
org.openidentityplatform.opendj:opendj-server-legacy (Maven) Vendor— Affected before 5.1.2 Fixed in 5.1.2 Patch available GHSA-p279-2cqp-84jg

Remediation

Fix · CNA OpenDJ (OpenIdentityPlatform) Fixed in 5.1.2
Fix · GHSA-p279-2cqp-84jg org.openidentityplatform.opendj:opendj-server-legacy (Maven) Fixed in 5.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-73644
2026-10-03 Alias added: GHSA-p279-2cqp-84jg

References

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences