CVE-2026-18651

Summary

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-287: Improper Authentication

Workarounds

When locking an account, also rotate its LDAP password. Locking the account alone is not enough: this flaw lets a bind with the account's still-valid password succeed even after it's locked.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References