Authentication bypass in Networknt light-4j via empty LDAP password
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass in BasicAuthHandler. An unauthenticated remote attacker can log in as LDAP or AD-delegated users by sending a Basic Authorization header with a known username and an empty password, because the resulting unauthenticated LDAP bind is accepted as successful authentication. The flaw is classified as Improper Authentication (CWE-287).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade networknt light-4j to version 2.4.0, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA light-4j (networknt) Fixed in 2.4.0
Timeline
- 2026-10-20 Threatist record created from CVE-2026-113682
- 2026-10-21 Alias added: GHSA-56rq-859m-p974
- 2026-10-23 CISA SSVC decision points changed
References
Patch 2
Other 4
- https://github.com/networknt/light-4j/issues/2804
- light-4j 2.4.0 Release Notes
- https://github.com/networknt/light-4j/blob/2.3.7/basic-auth/src/main/java/com/networknt/basicauth/BasicAuthHandler.java#L189-L200
- https://github.com/networknt/light-4j/blob/2.3.7/ldap-util/src/main/java/com/networknt/ldap/LdapUtil.java#L152-L173
More networknt vulnerabilities
- TI-2023-15125 light-oauth2 before version 2.1.27 obtains the public key without any verification. CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-113682 · CVE Program
- CVE-2026-113682 · NVD
- FIRST EPSS
- GHSA-56rq-859m-p974 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences