Critical Auth Bypass Found in OpenDJ Server

OpenDJ server-legacy versions prior to 5.1.2 contain a critical vulnerability, tracked as GHSA-p279-2cqp-84jg, that permits an unauthorized elevation of privilege. By failing to enforce required access control list scope checks during SASL PLAIN authentication, the system allows accounts with the proxied-auth privilege to impersonate other directory users without the necessary authorization grants.

What's at Risk

The vulnerability affects users of the org.openidentityplatform.opendj:opendj-server-legacy package. Organizations relying on this software for directory services and identity management are at risk if they utilize SASL PLAIN authentication mechanisms.

Systems that are internet-facing or have broad internal access to directory services are particularly exposed. Because this flaw allows an attacker to bypass intended identity restrictions, any environment relying on Access Control Instructions (ACIs) to segment user permissions is potentially compromised. While the directory manager or root account cannot be assumed via this method, the ability to act as other users undermines the core security model of the directory.

How the Flaw Works

This vulnerability falls into the category of authorization bypass. In a typical directory service, impersonation is a highly controlled operation. When a user requests to act on behalf of another entity, the system is expected to perform a two-step validation: verifying that the requester has the global privilege to perform a proxy action and checking that a specific access control rule permits them to impersonate that specific target.

When these checks are decoupled or partially implemented, an attacker can exploit the discrepancy to elevate their privileges. By supplying a target identity that they are not explicitly authorized to access, they can manipulate the directory's authentication logic. This type of weakness often occurs when a new authentication path is added to a system but fails to inherit the strict security policies applied to legacy or secondary authentication methods, such as DIGEST-MD5 or GSSAPI.

How to Protect Your Systems

• Upgrade to OpenDJ server-legacy version 5.1.2 or later immediately to apply the required mayProxy scope check.
• Restrict or revoke the proxied-auth privilege for all non-essential accounts until the patch is successfully deployed.
• Implement the principle of least privilege by auditing all accounts currently holding proxied-auth permissions to ensure they are strictly necessary.
• Monitor directory authentication logs for unusual bind requests or unexpected changes in user identity context during SASL sessions.
• Ensure that your identity management infrastructure is segmented from untrusted network zones to limit the potential impact of credential-based attacks.

Given the critical 9.6 CVSS score, the urgency of this remediation cannot be overstated. By failing to validate the mayProxy scope, the affected versions created a significant gap in identity governance. Promptly applying the vendor-provided patch is the only way to ensure that access control policies are consistently enforced across all authentication mechanisms.