The vulnerability exists in mitmproxy versions 12.2.1 and earlier; the built‑in LDAP proxy authentication does not correctly sanitize the username field, allowing an LDAP injection that enables a malicious client to bypass authentication when the proxyauth option is enabled. This flaw permits an attacker to authenticate as any user and gain access to intercept traffic and potentially privileged actions within the tool.

mitmproxy, an interactive TLS‑capable intercepting HTTP proxy used by penetration testers and developers. Any instance that has the proxyauth option with LDAP enabled and is running version 12.2.1 or earlier is affected. Versions 12.2.2 and later contain the fix and are not vulnerable.

The CVSS base score is 4.8, reflecting moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack vector is remote; an attacker who can send crafted LDAP queries to the proxy can exploit the flaw and authenticate as any user, gaining unauthorized access to intercepted data and the proxy’s internal functionality.