{"id":"CVE-2026-18922","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-18922","summary":"A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed…","details":"A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.","published":"2026-09-07T14:14:53.799Z","modified":"2026-09-08T13:04:34.933Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64771"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64776"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64778"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64779"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64780"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64781"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64783"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64784"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64785"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64790"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64792"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64793"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64804"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:64811"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-18922"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511388"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-08T13:04:34.933Z"}}