GHSA-p279-2cqp-84jg: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
(updated )
When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIED_AUTH privilege and never evaluated the “proxy” access-control right (the mayProxy ACI scope check). As a result, any account holding the proxied-auth privilege could assume any resolvable non-root identity without being granted a proxy ACI for that target.
This diverges from every other proxy path in OpenDJ — the proxied-authorization controls (RFC 4370) and the DIGEST-MD5 / GSSAPI authzid handlers all require both the privilege and the mayProxy scope grant.
References
- github.com/OpenIdentityPlatform/OpenDJ/commit/5c326850f1ab945cfca7ac9c5aaf77d1052c6bed
- github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2
- github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-p279-2cqp-84jg
- github.com/advisories/GHSA-p279-2cqp-84jg
- nvd.nist.gov/vuln/detail/CVE-2026-73644
Code Behaviors & Features
Detect and mitigate GHSA-p279-2cqp-84jg with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →