CVE-2026-113682
Received Received - Intake

Authentication Bypass in Light-4j via LDAP Bind

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113682
EUVD
EUVD-2026-105098

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
networknt light-4j 2.1.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Networknt light-4j versions 2.1.5 to 2.3.7. It allows attackers to log in as LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The system incorrectly accepts this as valid authentication due to improper handling in BasicAuthHandler and LdapUtil, which treat an unauthenticated LDAP bind as successful even with an empty password.

Detection Guidance

To detect this vulnerability, check if your light-4j version is between 2.1.5 and 2.3.7. Inspect BasicAuthHandler.java and LdapUtil.java for improper handling of empty passwords. Test by sending a Basic Authorization header with a valid username and empty password to see if authentication succeeds.

Impact Analysis

Attackers could gain unauthorized access to systems using light-4j with LDAP/AD delegation enabled. This may lead to data breaches, privilege escalation, or unauthorized actions. The impact depends on the system's configuration and whether LDAP directories accept unauthenticated binds with empty passwords.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR (e.g., Article 32 security of processing) and HIPAA (e.g., access controls under Security Rule §164.312(a)(1)). Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive data.

Mitigation Strategies

Upgrade light-4j to version 2.4.0 or later. Configure LDAP servers to reject unauthenticated binds with empty passwords. Patch BasicAuthHandler and LdapUtil to reject null or empty passwords before LDAP operations. Restrict affected routes if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart