CVE-2026-73644

This CVE represents a structural authorization failure, not merely a missing check. OpenDJ's SASL PLAIN handler correctly validates the PROXIED_AUTH privilege but fails to enforce the mayProxy ACI scope that should constrain that privilege. These two mechanisms — the privilege framework controlling what a user CAN do, and ACI controlling what they are permitted to do within that capability — operate without a unified gate. This creates a seam that attackers have historically exploited across directory services. CVE-2014-3610 in OpenDJ and CVE-2012-0874 in 389-ds targeted the same pattern: surgical fixes to privilege/ACI seams without auditing the underlying coordination logic. The blast radius of this flaw is the critical concern. PROXIED_AUTH is typically assigned to service accounts that authenticate other services across your infrastructure. These accounts are among the most exposed credentials in any deployment — they're embedded in configuration files, deployment artifacts, backup archives, and log aggregation systems precisely because they're not intended for human use and therefore receive minimal rotation hygiene. A single compromised PROXIED_AUTH holder can masquerade as any non-root identity to every system trusting that directory. This is not a targeted exploit; it's a single point of failure propagating trust across infrastructure. The fix returning INVALID_CREDENTIALS (49) rather than an authorization-specific error prevents identity enumeration but also reveals an uncomfortable truth: the authorization layer wasn't designed for composability. You shouldn't need to obscure what went wrong to prevent reconnaissance. The 'non-root' carve-out in the CVE description deserves scrutiny. Either root DNS resolution is separately enforced by another mechanism, or the fix addresses only where the bug was observed rather than the underlying coordination failure. Given the 12-year recurrence of nearly identical CVEs on this exact seam, assume the latter until proven otherwise. Audit your PROXIED_AUTH assignments — these are service accounts that likely outlived their original purpose.

Reviewed through automated stages and approved by a human before publication.