An authorization bypass exists in OpenDJ where accounts holding the PROXIED_AUTH privilege can assume any non‑root user identity without the necessary proxy ACL check. The flaw permits authentication as a different user using the SASL PLAIN mechanism, effectively granting the attacker the target’s permissions. This is a classic privilege escalation and authorization failure, classified under CWE‑285 and CWE‑639.

OpenIdentityPlatform’s OpenDJ directory service versions earlier than 5.1.2 are affected. Specifically the SASL PLAIN handler in opendj-server-legacy/processes user authentication requests involving the PROXIED_AUTH privilege. Users who are not root but whose identities can be resolved are vulnerable, regardless of whether the target is specified via dn: or u: authzid forms.

With a CVSS score of 9.6, the vulnerability is considered critical. No EPSS information is currently available, and it is not listed in CISA’s KEV catalog. The attack vector is likely a legitimate LDAP connection using SASL PLAIN over which an authenticated account that possesses PROXIED_AUTH attempts to set an authzid to any resolvable non‑root identity. If the target identity is not permitted by its proxy ACI, the fix now returns INVALID_CREDENTIALS, but prior to the patch the request would succeed, giving the attacker full access to the impersonated user’s data and permissions.