Spring LDAP's DirContextAuthenticationStrategy implementations do not reject bind requests when a non-empty username is paired with an empty or null password. This improper authentication weakness affects versions 2.4.0 to 2.4.4, 3.2.0 to 3.2.17, 3.3.0 to 3.3.7, and 4.0.0 to 4.0.3. The vulnerability has a CVSS 3.1 score of 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. No official patch or remediation level is currently stated in the vendor or CVE data. No known exploits in the wild have been reported.

Successful exploitation could allow an attacker to bypass authentication controls by submitting a bind request with a valid username but empty or null password, potentially leading to unauthorized access with confidentiality and integrity impacts. Availability is not affected. The vulnerability is exploitable remotely without privileges or user interaction but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional authentication validation controls or restrict access to vulnerable Spring LDAP instances. Monitor vendor channels for updates and apply patches promptly once released.