During SASL PLAIN authentication, the server installs the connection credentials before checking if the account is administratively locked. If a bind attempt succeeds, the server reports failure to the client when the account lock is discovered, yet the authenticated state on the connection is left unchanged. The adversary can use the same connection with the locked account’s privileges, effectively bypassing the lock that should have revoked that account’s access. This flaw, a manifestation of CWE‑287, allows a valid user to retain unauthorized access to resources even after the account has been locked.

Red Hat Directory Server versions 11, 12 and 13 as well as the Red Hat Enterprise Linux distributions 6 through 10 are affected. No additional version qualifiers were provided, so the entire scope of these products may be impacted.

The vulnerability’s CVSS score of 5.4 indicates moderate severity; the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote LDAP client that can authenticate using SASL PLAIN with an account that has been locked. The attacker must already possess valid credentials for the locked account; once credentials are known, the flaw enables the attacker to maintain privileged access through the existing connection, circumventing the intended lockout. Because the authentication bypass occurs during normal protocol operation, exploitation requires only network visibility and knowledge of the account credentials.