OpenDJ versions before 5.1.2 contain an improper authorization vulnerability in the SASL PLAIN mechanism handler. Specifically, the code checked the PROXIED_AUTH privilege but failed to evaluate the 'mayProxy' proxy Access Control Instruction (ACI) scope when an authorization identity (authzid) resolved to a different user. This allowed an authenticated account holding PROXIED_AUTH to assume any resolvable non-root identity outside the permissions granted by its proxy ACI, using dn:, u:, or bare authzid forms. The vulnerability is addressed in version 5.1.2 by returning an INVALID_CREDENTIALS (49) error before password verification if the target authorization identity is not authorized.

An attacker with an authenticated account possessing the PROXIED_AUTH privilege can bypass proxy ACI restrictions and assume unauthorized identities other than root. This leads to a complete compromise of confidentiality and integrity for those unauthorized identities, as indicated by the CVSS score of 9.6 with high confidentiality and integrity impact and no impact on availability.

Upgrade OpenDJ to version 5.1.2 or later, where the vulnerability is fixed by proper authorization checks returning INVALID_CREDENTIALS before password verification when the target authorization identity is not permitted. No other mitigations are specified.