An LDAP authentication bypass flaw in RT allows an attacker to authenticate as any LDAP‑backed user by supplying an empty password or exploiting certain LDAP server configurations. This flaw directly compromises user identity, enabling the attacker to assume the permissions of any affected account, thereby undermining confidentiality, integrity, and availability of the ticketing platform. The vulnerability is classified as CWE‑287, an authentication failure weakness.

The issue affects bestpractical’s RT product versions 5.0.9 and earlier, as well as 6.0.0 through 6.0.2. These releases permit LDAP or AD based authentication. The flaw has been corrected in RT 5.0.10 and 6.0.3.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Although the EPSS score is not published, the existing exploitation vector—unauthenticated LDAP bind under specific configurations—remains a realistic attack path. The flaw is not yet listed in CISA KEV. An attacker can leverage standard LDAP interaction to obtain valid session tokens for any user, potentially escalating to full administrative control if the account privileges allow.