CVE-2026-113682: Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments running Networknt light-4j versions from 2.1.5 up to, but not including, 2.4.0 are affected when BasicAuthHandler delegates authentication to LDAP or Active Directory.
What does an attacker need to exploit it?
An attacker needs network access to the affected authentication endpoint and a known LDAP/AD-delegated username. They can submit a Basic Authorization header containing that username with an empty password; no valid credentials or user interaction are required.
How can I identify attempted exploitation?
Review authentication and application logs for Basic authentication attempts using known usernames with an empty password, especially where LDAP or AD authentication was recorded as successful.