OpenDJ versions prior to 5.1.1 contain a deserialization of untrusted data vulnerability (CWE-502) in the JMX RMI connector. The connector processes attacker-controlled credential objects before authentication without a restrictive credentials filter pattern, and the RmiAuthenticator accepts an unconstrained Object array instead of a restricted String array. When the JMX Connection Handler is enabled and reachable, an unauthenticated remote attacker can submit crafted serialized Java objects to execute arbitrary code in the OpenDJ server process. Exploitation depends on the runtime classpath and Java version. The vulnerability was demonstrated on OpenDJ 4.4.15 with JDK 11 and Jackson 2.12.6.1. The vulnerability is resolved in OpenDJ 5.1.1.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the OpenDJ server process, potentially leading to full system compromise. The attack requires the JMX Connection Handler to be enabled and reachable, which is disabled by default. The severity is critical with a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability.

Upgrade OpenDJ to version 5.1.1 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the JMX Connection Handler is disabled (default setting) to prevent exposure. Review runtime environment and classpath to reduce attack surface. Patch status is confirmed fixed in 5.1.1.