Live › vulnerability › CVE-2026-113682
Go to dashboardlight-4j is a Java microservices framework whose BasicAuthHandler accepts an LDAP bind with an empty password as a successful login. An unauthenticated attacker who knows a username can send a Basic Authorization header with an empty password and be logged in as that LDAP or Active Directory user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the light-4j version in the project's pom.xml or build.gradle; affected versions are 2.1.5 up to but not including 2.4.0.
Upgrade light-4j to 2.4.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-113682")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.