CVE-2026-73644

Name of the Vulnerable Software and Affected Versions OpenDJ versions prior to 5.1.2

Description The SASL PLAIN authorization identity path in the PlainSASLMechanismHandler.java file fails to evaluate the mayProxy proxy ACI (Access Control Instruction) scope when an authorization identity resolves to a different user. Although the PROXIED AUTH privilege is checked, the lack of scope evaluation allows an authenticated account with PROXIED AUTH to assume any resolvable non-root identity, even those not permitted by its proxy ACI. This can be achieved using dn:, u:, or bare authorization identity forms.

Recommendations Update to version 5.1.2.