CVE-2026-11748

Name of the Vulnerable Software and Affected Versions centraldogma-server-auth-shiro versions prior to 0.84.0

Description An issue exists in the SearchFirstActiveDirectoryRealm where the login username is substituted into an LDAP search filter without neutralizing LDAP filter metacharacters. This allows an unauthenticated attacker to manipulate the filter, leading to authentication confusion and the ability to enumerate the directory structure. LDAP injection occurs when an application fails to properly sanitize user-supplied input used in a Lightweight Directory Access Protocol (LDAP) query.

Recommendations Update to version 0.84.0 or later.