A vulnerability in 389 Directory Server (Red Hat Directory Server 11) occurs during SASL PLAIN authentication where the server installs connection-level bind credentials before performing an account-lock check. If the account is administratively locked, the bind is reported as failed to the client, but the authenticated state on the connection is not reverted. This allows continued access using the locked account's privileges despite the lock. The issue does not allow privilege escalation beyond the locked account's rights. The vulnerability is due to improper authentication handling, specifically the order of operations in credential installation and account lock verification. The vendor advisory recommends rotating the LDAP password when locking accounts to mitigate the issue. No official patch or fix status is provided in the advisory, and the vulnerability is rated medium severity with a CVSS 3.1 base score of 5.4.

An attacker with valid credentials for an administratively locked account can authenticate via SASL PLAIN and maintain an authenticated connection despite the account lock. This bypasses account lock as an access-revocation control, allowing continued read and write access to resources permitted to that account. There is no privilege escalation or access beyond the locked account's existing permissions. Availability is not impacted.

Red Hat advises that locking an account alone is insufficient to prevent access due to this flaw. To mitigate, administrators should rotate the LDAP password when locking accounts to invalidate existing credentials. No official patch or fix is currently confirmed; check the Red Hat advisory for updates. No additional mitigation actions are recommended beyond password rotation on locked accounts.