Answer in brief
CVE-2026-73644 records a Critical severity (CVSS 9.6) vulnerability in OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-73644 records a Critical severity (CVSS 9.6) vulnerability in OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenDJgeneric | < 5.1.2 | Not reported |
| org.openidentityplatform.opendj:opendj-server-legacymaven | >=0 <5.1.2 | 5.1.2 |
| org.openidentityplatform.opendj:opendj-server-legacymaven | <=5.1.1 | 5.1.2 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
Quoted source text, attributed separately from HOL analysis.
CVSS is 9.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenDJgeneric | < 5.1.2 | Not reported |
| org.openidentityplatform.opendj:opendj-server-legacymaven | >=0 <5.1.2 | 5.1.2 |
| org.openidentityplatform.opendj:opendj-server-legacymaven | <=5.1.1 | 5.1.2 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
Quoted source text, attributed separately from HOL analysis.