Description

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

RFC 4513 Section 5.1.2 defines this as an unauthenticated bind. On LDAP servers that permit such binds, an attacker with a valid username and an empty password can bypass password verification.

This affects authentications performed through AbstractContextSource, LdapTemplate, and LdapClient.

This is similar to a vulnerability previously announced in Spring Security as CVE-2014-0079.

Affected Spring Products and Versions

Spring LDAP:

• 2.4.0 - 2.4.4
• 3.2.0 - 3.2.17
• 3.3.0 - 3.3.7
• 4.0.0 - 4.0.3
• Unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N&version=3.1

History

• 2026-06-08: Initial vulnerability report published.