CVE-2020-26168

The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.

• CWE-287

• https://docs.hazelcast.org/docs/ern/index.html#4-0-3Release Notes, Vendor Advisory
• https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-BypassVendor Advisory
• https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-BypassVendor Advisory
• https://jet-start.sh/blog/2020/10/23/jet-43-is-releasedVendor Advisory
• https://docs.hazelcast.org/docs/ern/index.html#4-0-3Release Notes, Vendor Advisory
• https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-BypassVendor Advisory
• https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-BypassVendor Advisory
• https://jet-start.sh/blog/2020/10/23/jet-43-is-releasedVendor Advisory

Published

Nov 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26162Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 …6.1
• CVE-2020-26163BigBlueButton Greenlight before 2.5.6 allows HTTP header (Ho…8.8
• CVE-2020-26164In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attac…5.5
• CVE-2020-26165qdPM through 9.1 allows PHP Object Injection via timeReportA…8.8
• CVE-2020-26166The file upload functionality in qdPM 9.1 doesn't check the …5.4
• CVE-2020-26167In FUEL CMS 11.4.12 and before, the page preview feature all…9.8
• CVE-2020-2617Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26171In tangro Business Workflow before 1.18.1, the documentId of…4.3
• CVE-2020-26172Every login in tangro Business Workflow before 1.18.1 genera…6.5
• CVE-2020-26173An incorrect access control implementation in Tangro Busines…4.3
• CVE-2020-26174tangro Business Workflow before 1.18.1 requests a list of al…8.8
• CVE-2020-26175In tangro Business Workflow before 1.18.1, an attacker can m…6.5