The Jakarta Security LDAP identity store fails to neutralize special characters in the caller name before using it in directory queries. This vulnerability allows a remote unauthenticated attacker to manipulate LDAP queries to enumerate accounts, infer directory attribute values, or affect which directory entry is used for login validation. The issue affects only applications using the LDAP identity store. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.