The vulnerability in 389-ds-base (Red Hat Directory Server 11) involves the server not discarding plaintext bytes buffered from a client connection during StartTLS negotiation. An attacker positioned on the communication path can inject a crafted LDAP message that is processed post-TLS upgrade. Due to message ID collision, the server's response to the injected message is delivered to the client instead of the response to the client's original operation. This can cause client applications to incorrectly interpret a failed bind (authentication) attempt as successful.

An attacker able to intercept and modify network traffic can exploit this flaw to cause client applications to accept failed authentication attempts as successful. This undermines authentication integrity, potentially allowing unauthorized access or bypass of security controls. The CVSS score of 9.0 reflects critical impact on confidentiality, integrity, and availability.

Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-86345 for official remediation details. Patch status is not yet confirmed from the provided data; therefore, verify the vendor advisory for current remediation guidance. Until a fix is applied, consider restricting network access to trusted endpoints and monitoring for anomalous LDAP traffic patterns related to StartTLS negotiation.