VULNERABILITY INTELLIGENCE

CVE-2026-18651

CVSS score5.4 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2026-08-03
Last modified2026-08-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

Weakness classification

  • secalert@redhat.com: CWE-287

Primary references