OpenDJ Vulnerabilities: Authorization Bypass (CVSS 9.6) and Unauthenticated SSRF (CVSS 9.4)
Do Son 
TL;DR
OpenDJ 5.1.2 fixes four security flaws in the open-source LDAP directory server. The two most severe OpenDJ vulnerabilities are a CVSS 9.6 authorization bypass and a CVSS 9.4 unauthenticated SSRF. Two lower-rated deserialization and denial-of-service bugs round out the set.
Why It Matters
OpenDJ handles identity, authentication, and access control for enterprises. A directory server is a high-value target, since it sits at the center of who can log in and what they can reach. So a bypass here undermines the trust boundary the whole deployment rests on.
How the Attacks Work
SASL PLAIN authorization bypass (CVSS 9.6)
This is the headline flaw. A SASL PLAIN bind can supply an authorization identity that resolves to another user. The handler checked only the proxied-auth privilege. However, it skipped the “proxy” access-control right that every other proxy path in OpenDJ enforces. As a result, any account with proxied-auth could assume arbitrary non-root identities. The Directory Manager account is not assumable this way.
Unauthenticated SSRF in the DSMLv2 gateway (CVSS 9.4)
The DSMLv2 SOAP gateway dereferences attacker-supplied URI values server-side. It applied no scheme allowlist, no egress filter, and no size cap. Worse, the endpoint is reachable without authentication by default. A remote attacker can therefore force server-side requests to internal services or the cloud metadata endpoint. The same flaw enables local file reads through file: URIs and a memory-exhaustion denial of service.
JMX deserialization and VLV memory exhaustion
CVE-2026-62373 (CVSS 6.6) continues an earlier fix. Once authenticated, a user with JMX_READ can drive Java deserialization through MBean arguments, since no serial filter applies. CVE-2026-62375 (CVSS 7.5) lets a single crafted VLV search request exhaust server memory, a denial of service reachable in a default configuration.
Exploitation Status
The vendor documented all four issues in its GitHub security advisories. No exploitation in the wild has been confirmed, and no public proof-of-concept exists at this time. The two critical flaws are currently tracked by GHSA advisory IDs, with CVE assignment pending.
Affected Versions
All four OpenDJ vulnerabilities affect versions 5.1.1 and earlier. Version 5.1.2 contains every fix.
Patch and Mitigation Steps
Upgrade to OpenDJ 5.1.2 as the primary fix. The release disables anyURI dereferencing by default and requires authentication on the DSMLv2 gateway.
Some interim steps reduce exposure before you patch. Restrict or revoke the proxied-auth privilege to blunt the authorization bypass. Disable the DSMLv2 gateway if you do not use it. Keep the JMX connection handler off, since it is disabled by default. Finally, install a connector-wide JMX serial filter that allowlists only the management types OpenDJ accepts.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
