OpenDJ EUVD-2026-58186

Exploitation requires an authenticated bind by an account that has been granted the proxied-auth privilege (ds-privilege-name: proxied-auth) and that the server accept a SASL PLAIN bind carrying an authorization identity (authzid) in dn:, u:, or bare form. The specific weakness is that this account does NOT need a proxy ACI (mayProxy grant) for the target - the missing ACI check is exactly what is bypassed. Limiting factors that reduce realistic risk: the attacker must first hold a valid account with the proxied-auth privilege (PR:L, not anonymous), the target identity must be a resolvable non-root directory entry, and the Root/Directory Manager identity is explicitly not assumable via this path. Deployments that never grant proxied-auth to any account are not exposed.

The signals are largely aligned toward high real-world risk for affected deployments: CVSS 3.1 base 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a network-reachable, low-complexity attack with a scope change and high confidentiality/integrity impact, and the vendor GHSA advisory independently confirms the authorization bypass and its impact. The critical mitigating factor is PR:L: exploitation is not open to anonymous or arbitrary users - it requires an already-authenticated account that has been granted the proxied-auth privilege, so the realistic threat is a semi-trusted or compromised proxy account escalating beyond its intended impersonation scope, or an insider abusing an over-broadly granted privilege. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation-probability data is genuinely missing rather than low - this should be treated as a priority based on severity and the low exploitation complexity for anyone already holding the privilege, and any organization running an internet- or partner-facing OpenDJ instance with proxied-auth granted, even a mid-sized municipal IT team in leszno, should treat it as urgent rather than deferring. Note one bounded limit that reduces worst-case impact: the Root/Directory Manager identity is explicitly not assumable through this path.

An attacker who controls or compromises a low-value OpenDJ service account that happens to hold the proxied-auth privilege opens a SASL PLAIN bind and supplies an authzid (e.g. dn:cn=admin,o=corp or u:administrator) for a higher-value user the account was never granted a proxy ACI to impersonate. Because the pre-5.1.2 handler checks only the privilege and not the ACI scope, the bind succeeds and subsequent LDAP operations execute with the victim's identity and access rights. No public proof-of-concept is identified at time of analysis, but the attack is low-complexity for anyone already holding the privilege.