CVE-2026-18651
published 2026-08-03CVE-2026-18651: A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the…
PriorityP434medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.28%
19.6th percentile
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 389-ds_1.4 | 389-ds-base | — | — |
| port389 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-08-03
CVE-2026-18651 [MEDIUM] CWE-287 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
Red Hat
389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
vendor_redhat·2026-08-03·CVSS 5.4
CVE-2026-18651 [MEDIUM] CWE-287 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
Statement: This flaw lets a user authenticate to an already-locked account (nsA
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account [fedora-all]
bugzilla·2026-08-03·CVSS 5.4
CVE-2026-18651 [MEDIUM] CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account [fedora-all]
CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in 389 Directory Server (389-ds-base). In ids_sasl_check_bind(), on a successful SASL_OK from the underlying Cyrus SASL library, the connection is marked SASL-complete and bind credentials are installed via bind_credentials_set_nolock() before the account-lock check (slapi_check_account_lock()) is performed for non-root binds. If the subsequent lock check determines the account i
Bugzilla
CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
bugzilla·2026-08-03·CVSS 5.4
CVE-2026-18651 [MEDIUM] CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
CVE-2026-18651 389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
A flaw was found in 389 Directory Server (389-ds-base). In ids_sasl_check_bind(), on a successful SASL_OK from the underlying Cyrus SASL library, the connection is marked SASL-complete and bind credentials are installed via bind_credentials_set_nolock() before the account-lock check (slapi_check_account_lock()) is performed for non-root binds. If the subsequent lock check determines the account is locked (nsAccountLock: true), the bind is failed and reported to the client, but the already-installed SASL-complete flag and bind credentials are not reverted. A client that already knows the correct password for an account that has si
2026-08-03
Published