This vulnerability in 389 Directory Server occurs during SASL PLAIN authentication where a stale identity from a prior failed bind attempt is retained in a Cyrus SASL auxiliary property and applied after a subsequent unrelated successful bind on the same connection. An attacker can exploit this by first sending a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then completing a SASL ANONYMOUS or a valid low-privileged bind on the same connection, causing the server to grant Directory Manager privileges without valid credentials. This results in improper authentication and privilege escalation. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, impacting confidentiality, integrity, and availability. No official fix has been released yet, but Red Hat advises mitigation by restricting allowed SASL mechanisms to exclude PLAIN.

A remote unauthenticated attacker can gain full Directory Manager privileges over an LDAPS connection without valid credentials or user interaction. This leads to complete compromise of confidentiality, integrity, and availability of the directory server. The flaw allows privilege escalation to the highest level, enabling unauthorized access and control over directory data and operations.

Red Hat advises administrators to restrict the nsslapd-allowed-sasl-mechanisms configuration to only the SASL mechanisms actually required, such as GSSAPI, EXTERNAL, or GSS-SPNEGO, explicitly excluding PLAIN. Removing PLAIN prevents the initial failed bind that plants the stale identity, thereby blocking exploitation of both the anonymous and low-privileged account variants. No official patch or fix has been released yet; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.