The vulnerability in 389 Directory Server (CVE-2026-18651) occurs because the server installs connection-level bind credentials before performing the account-lock check during SASL PLAIN authentication. If the account is administratively locked, the server reports the bind as failed to the client, but does not revert the already-installed authenticated state on the connection. Consequently, a client supplying valid credentials for a locked account can continue using the connection with that account's privileges, effectively defeating the account lock as an access-revocation control. This issue allows continued access to the account's permitted resources without privilege escalation. The flaw is related to improper authentication (CWE-287) and has a CVSS v3.1 base score of 5.4 (medium severity).

An attacker or user with valid credentials for an administratively locked account can still authenticate via SASL PLAIN and maintain an authenticated session despite the account lock. This bypasses the intended access revocation mechanism of account locking, allowing continued read and write access to resources permitted to that account. There is no privilege escalation beyond the account's existing rights, and no denial of service or availability impact is reported.

Red Hat advises that locking an account alone is insufficient to prevent access due to this flaw. To mitigate, administrators should rotate the LDAP password when locking an account to invalidate existing credentials. There is no official patch or fix currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.