SASL PLAIN Authentication Vulnerability in 389 Directory Server by Red Hat

CVE-2026-18922

What is CVE-2026-18922?

A serious security flaw has been identified within the 389 Directory Server, where an attacker can exploit the SASL PLAIN authentication method. During the authentication process, a stale identity associated with a failed bind attempt can improperly carry over into a new, unrelated successful bind. This vulnerability allows an attacker to utilize an incorrect password with the ‘cn=Directory Manager’ bind and subsequently, through a valid SASL ANONYMOUS bind on the same connection, gain unauthorized Directory Manager privileges without presenting valid credentials. Additionally, there exists a variant of this issue that permits the exploitation of a successful bind using valid low-privileged account credentials, amplifying the risk of unauthorized access significantly.

References