Light 4J
Monthly
Authentication bypass in Networknt light-4j 2.1.5 before 2.4.0 lets unauthenticated attackers impersonate LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The flaw is only reachable where BasicAuthHandler uses LDAP/AD delegation and the backing directory treats a non-empty username with an empty password as a successful bind; static/config-file Basic auth and bearer-token deployments are not affected, and directories that reject empty-password binds neutralize the attack. Vendor-released patch: 2.4.0; no public exploit identified at time of analysis.
Authentication bypass in Networknt light-4j 2.1.5 before 2.4.0 lets unauthenticated attackers impersonate LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The flaw is only reachable where BasicAuthHandler uses LDAP/AD delegation and the backing directory treats a non-empty username with an empty password as a successful bind; static/config-file Basic auth and bearer-token deployments are not affected, and directories that reject empty-password binds neutralize the attack. Vendor-released patch: 2.4.0; no public exploit identified at time of analysis.