---
id: CVE-2026-73644
title: OpenDJ is an LDAPv3 compliant directory service
summary: >-
  OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL
  PLAIN authorization identity path in
  opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java
  checked the PROXIED_AUTH privil…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-285
  - CWE-639
published: '2026-08-13'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73644'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenDJ/commit/5c326850f1ab945cfca7ac9c5aaf77d1052c6bed
    label: security-advisories@github.com
  - url: 'https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-p279-2cqp-84jg
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00294
epssPercentile: 0.22288
ingestedAt: '2026-09-18T20:51:25.608Z'
---

## Overview

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.