Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.

An attacker who could reach the LDAP listener port could authenticate using the well-known administrative bind DN, and then read or modify entries in the in-memory directory.

Preconditions:

1. The application uses UnboundIdContainer — configured directly or through Spring Boot auto-configuration (spring.ldap.embedded.* properties).
2. The LDAP listener port is reachable from the attacker's network position (not restricted to localhost by an external firewall or network policy).