light-4j CVE-2026-113682

Exploitation requires the target to run light-4j's BasicAuthHandler configured for LDAP/AD-delegated authentication (versions 2.1.5 up to but not including 2.4.0), and requires the backing LDAP/Active Directory server to treat a bind with a non-empty username and empty password as a successful (unauthenticated) bind rather than rejecting it. The attacker must also know or guess a valid directory username. Limiting factors: the flaw is not reachable in deployments using static/config-file Basic auth or Bearer-token auth instead of LDAP delegation, and directories hardened to reject empty-password binds neutralize the attack; no user interaction, no authentication, and no non-default network exposure are otherwise needed.

This is a genuine high-priority authentication bypass, not merely a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) confirms a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact - fully consistent with the description of logging in as an LDAP/AD-delegated user with only a known username and empty password. The one tempering signal is AT:P (attack requirements present), which correctly captures that exploitation depends on the deployment using BasicAuthHandler in LDAP-delegation mode AND the backing directory accepting an unauthenticated (empty-password) bind as success - a common LDAP/AD behavior but not universal. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was supplied in the intelligence, so there is no evidence of active exploitation - the risk is driven by the trivial exploitation technique and the presence of a vendor patch and a public issue/PR (which effectively disclose the mechanism), not by observed in-the-wild activity. The signals are internally consistent (network vector, no privileges, config-dependent) with no contradictions to flag.

An attacker who knows or guesses a valid directory username (e.g., an email or sAMAccountName) sends an HTTP request to a light-4j service protected by BasicAuthHandler, supplying a Basic Authorization header with that username and an empty password. The handler performs an LDAP bind with the empty password, which the directory treats as a successful (unauthenticated) bind, so the attacker is logged in as that user without knowing the password. No public exploit code was identified at time of analysis, but the fix commit and public issue make the technique straightforward to reproduce.