OpenDJ SASL PLAIN Vulnerability: Critical CVE Under Investigation
- Severity
- HIGH
- Affected component
- opendj-server-legacy (maven)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in OpenDJ SASL PLAIN that reportedly allows bypassing the proxy ACI scope check, leading to potential privilege escalation.
What happened
The vulnerability, tracked as GHSA-P279-2CQP-84JG and CVE-2026-73644, affects the OpenDJ SASL PLAIN mechanism. It appears to enable a user with proxied-auth to assume any resolvable non-root identity without proper ACI grants. This could result in unauthorized access and privilege escalation. The affected component is opendj-server-legacy (maven), with versions <= 5.1.1 reported as vulnerable. Patched version 5.1.2 is available.
This issue was first flagged on July 24, 2026. It is under investigation and has not yet been exploited in the wild. The severity is classified as high due to the potential for significant impact on system security.
What to do about it
- Upgrade to opendj-server-legacy version 5.1.2 or later to mitigate the vulnerability.
- Ensure that the mayProxy scope check is enforced on the SASL PLAIN authzid path in your configuration.
- Monitor the primary sources for updates and further instructions.
- Review your system's access control configurations to ensure they align with security best practices.
- Conduct a security audit to identify any potential unauthorized access that may have occurred prior to patching.
How 0Day would have caught this
opendj-server-legacy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using opendj-server-legacy (maven) version <= 5.1.1, you are potentially affected.
What should I do right now?
Upgrade to opendj-server-legacy version 5.1.2 or later and ensure the mayProxy scope check is enforced.
Has this been exploited in the wild?
No, this vulnerability has not yet been exploited in the wild.
Where can I find more information?
Consult the primary sources: GHSA-p279-2cqp-84jg on GitHub and the OpenIdentityPlatform/OpenDJ repository.