The Apache Directory LDAP API version 2.1.7 fails to verify that the LDAP server’s TLS certificate matches the intended hostname. As a result, an attacker who can perform a man‑in‑the‑middle (MITM) attack and present any certificate that is trusted by the client's trust store can impersonate the LDAP server, leading to full compromise of confidentiality, integrity, and authentication. This flaw is categorized as CWE‑297, an insecure implementation of TLS hostname verification.

The vulnerability affects the Apache Directory LDAP API produced by the Apache Software Foundation, specifically version 2.1.7. No other product versions were mentioned. Users of this library who connect to LDAP servers over TLS should verify that the certificate returned by the server matches the expected hostname to avoid the risk of impersonation.

With a CVSS score of 8.8, this issue is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can intercept traffic and supply a certificate that is trusted by the client's trust store. Once the MITM is in place, the client will accept the certificate despite hostname mismatches, enabling the attacker to read, modify, or forge LDAP communications. The likely attack vector is a network MITM capable of presenting a trusted certificate.