CVE-2026-11748: Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Threat model: any unauthenticated network client that can reach the Central Dogma login page. No prior account, no MITM position required — the attack is performed during a normal login request.

1. Authentication confusion — In AD environments that select this realm (the canonical LINE corporate scenario), typing username * causes the realm to look up the first directory entry (typically Administrator, admin, or a service account in alphabetical AD ordering) and attempt bind with the attacker’s password. If the attacker also possesses any valid user’s password — easily obtained via password reuse, accidental Slack leak, repo commit, or peer compromise — and that password happens to authenticate the first directory entry (rare but devastating), the attacker logs in as a privileged user while audit logs record the literal username *.

2. Audit log evasion / compliance failure — Payloads like bob)(uid=alice are logged verbatim while the LDAP filter is malformed. Central Dogma’s audit trail is a primary control for configuration change accountability. Loss of accountability constitutes a direct violation of SOX §404, PCI-DSS §10, ISO 27001 A.12.4.

3. Directory enumeration — Wildcard payloads (a*, b*, …) combined with timing analysis allow blind enumeration of corporate AD structure: user existence, OU layout, admin group membership. While AD structure is not strictly secret, leaking it from an internet-exposed Central Dogma feeds spear-phishing target lists.

4. Group-membership filter injection — Payload a)(objectClass=*)(memberOf=CN=Domain Admins,... (against the common AD filter (&(objectClass=user)(sAMAccountName={0}))) narrows the search to Domain Admin members and returns the first one. The attacker need only know any Domain Admin’s password (separately compromised) to land in Central Dogma as that user. AD itself is not breached, but Central Dogma’s view of the principal is.

Scope is Changed (CVSS) because the injection traverses the trust boundary between Central Dogma and the separate AD/LDAP security authority.