OpenDJ server legacy versions before 5.1.2 contain a vulnerability in the SASL PLAIN bind mechanism where supplying an authorization identity (authzid) that resolves to a different user bypasses the proxy access control instruction (ACI) scope check. Specifically, the PlainSASLMechanismHandler verifies only the PROXIED_AUTH privilege but does not evaluate the 'proxy' access-control right (mayProxy ACI scope). Consequently, any account with the proxied-auth privilege can impersonate any resolvable non-root identity without the required proxy ACI grant. This behavior deviates from other proxy paths like DIGEST-MD5 and GSSAPI, which require both privilege and mayProxy scope. The vulnerability enables privilege escalation and authorization bypass, allowing unauthorized impersonation of directory users. The fix involves enforcing the mayProxy scope check on the SASL PLAIN authzid path and returning INVALID_CREDENTIALS before password verification to prevent information leakage. Until patched, restricting or revoking the proxied-auth privilege is recommended.

An attacker holding the proxied-auth privilege can escalate privileges by impersonating arbitrary directory users beyond the scope intended by proxy ACIs, effectively bypassing authorization controls. This compromises confidentiality and integrity of directory data for affected users. The root or Directory Manager accounts cannot be assumed via this method. The vulnerability does not impact availability.

A fix is available in OpenDJ server legacy version 5.1.2 that enforces the mayProxy scope check on the SASL PLAIN authzid path, aligning it with other proxy authorization mechanisms. Until upgrading, it is recommended to restrict or revoke the proxied-auth privilege to prevent exploitation. No other mitigations are specified.