CVE-2026-18651

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description An issue exists during SASL PLAIN authentication where the server installs connection-level bind credentials before verifying if the account is locked. If the account is locked, the server notifies the client that the bind failed, but it fails to revert the authenticated state on the connection. Consequently, a client providing valid credentials for an administratively locked account can maintain the connection and operate with that account's privileges, bypassing the account lock access-revocation control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.