Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-03T00:00:00 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CWE-287

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

This flaw lets a user authenticate to an already-locked account (nsAccountLock: true) via SASL PLAIN, using that account's own correct password. The server checks the password before it checks the lock, so the connection becomes authenticated even though the client is told the bind failed. After bind, the user can read and modify what that account was already permitted to touch - no escalation and access beyond it's own rights. Red Hat would like to thank Andrew Rukin (Arenadata) and Chris Jarrett-Davies (OpenAI Security Research) for reporting this issue. When locking an account, also rotate its LDAP password. Locking the account alone is not enough: this flaw lets a bind with the account's still-valid password succeed even after it's locked. Red Hat Directory Server 11 Fix deferred 389-ds-base Red Hat Directory Server 12 Fix deferred 389-ds-base Red Hat Directory Server 13 Fix deferred 389-ds-base Red Hat Enterprise Linux 10 Fix deferred 389-ds-base Red Hat Enterprise Linux 6 Not affected 389-ds-base Red Hat Enterprise Linux 7 Fix deferred 389-ds-base Red Hat Enterprise Linux 8 Fix deferred 389-ds:1.4/389-ds-base Red Hat Enterprise Linux 9 Fix deferred 389-ds-base https://www.cve.org/CVERecord?id=CVE-2026-18651 https://nvd.nist.gov/vuln/detail/CVE-2026-18651