CVE-2026-113682

7.4High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-287

Impact

Unauthenticated remote attackers can bypass authentication and log in as any valid LDAP/AD user. They only need network access to the service and a known username.

Root cause

The BasicAuthHandler allows empty passwords, triggering an anonymous LDAP bind that is mistakenly treated as a successful authentication.

Affected systems

Networknt light-4j from 2.1.5 before 2.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade light-4j dependencies to version 2.4.0 or newer. As an interim workaround, reject requests with empty basic auth passwords at your reverse proxy or API gateway before they reach light-4j.

shell

$ mvn versions:use-dep-version -Dincludes=com.networknt:* -DdepVersion=2.4.0 -DforceVersion=true

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113682