Networknt light‑4j 2.1.5 up to 2.3.x contains an authentication bypass flaw in the BasicAuthHandler that allows an unauthenticated attacker to supply a known LDAP/AD username with an empty password. The handler treats an empty password as a successful LDAP bind, granting the attacker access as the specified user and potentially enabling elevated privileges without proper authentication.

The affected product is networknt light‑4j versions 2.1.5 through 2.3.x, before the release of 2.4.0. Users running any of those versions are susceptible to this bypass vulnerability.

The CVSS score of 9.1 highlights the critical nature of this flaw. EPSS is not available, so the current probability of exploitation is unknown, but the flaw is not included in CISA's KEV. The likely attack vector is an HTTP client that sends a Basic Authorization header with a valid username and an intentionally empty password string, triggering the unauthenticated LDAP bind that is considered successful.