OpenDJ versions before 5.1.2 contain an improper authorization vulnerability (CWE-285) in the SASL PLAIN mechanism handler. Specifically, when an authorization identity (authzid) resolved to a different user, the code checked the PROXIED_AUTH privilege but failed to evaluate the mayProxy proxy Access Control Instruction (ACI) scope. This allowed authenticated accounts holding PROXIED_AUTH to assume any resolvable non-root identity outside the permitted proxy ACI scope, including dn:, u:, or bare authzid forms. The vulnerability is addressed in OpenDJ 5.1.2 by returning INVALID_CREDENTIALS (49) before password verification if the target authorization identity is not allowed.

An attacker with an authenticated account holding the PROXIED_AUTH privilege could bypass proxy ACI restrictions and assume unauthorized identities. This leads to a complete compromise of confidentiality and integrity for the affected directory service, as unauthorized identity assumption can grant access to sensitive data or operations. Availability is not impacted.

Upgrade OpenDJ to version 5.1.2 or later, where the vulnerability is fixed by proper evaluation of proxy ACI scope and rejection of unauthorized authorization identities before password verification. No other mitigation is indicated or required.