CVE-2026-113682 networknt CVE debrief

Who should care

Defenders responsible for systems using Networknt light-4j versions between 2.1.5 and 2.4.0 should assess exposure and potential impact. This includes teams managing authentication and authorization mechanisms, as well as those responsible for monitoring and incident response.

Why it matters

CVE-2026-113682 is a critical authentication bypass vulnerability in Networknt light-4j versions 2.1.5 to 2.3.7. Defenders should prioritize verifying exposure, assessing potential impact, and implementing compensating controls to mitigate potential authentication bypass.

• Potential unauthorized access to sensitive data
• Possible lateral movement within compromised networks
• Need for verification of light-4j version and exposure
• Potential impact on authentication and authorization mechanisms

Technical summary

Networknt light-4j versions 2.1.5 to 2.3.7 contain an authentication bypass vulnerability in BasicAuthHandler. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication. This vulnerability allows unauthenticated attackers to log in as LDAP/AD-delegated users. The issue arises from the improper handling of empty passwords in the BasicAuthHandler, which can be exploited to bypass authentication mechanisms. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using light-4j versions between 2.1.5 and 2.4.0, and implementing compensating controls to

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using light-4j versions between 2.1.5 and 2.4.0, and implementing compensating controls to mitigate potential authentication bypass.

Recommended defensive actions

• Verify light-4j version and check for exposure
• Assess potential impact on systems using affected versions
• Implement compensating controls to mitigate authentication bypass
• Monitor for potential exploitation attempts
• Review vendor patch guidance for light-4j
• Conduct exposure review for systems using light-4j versions between 2.1.5 and 2.4.0
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in Networknt light-4j versions 2.1.5 to 2.3.7. The vulnerability allows unauthenticated attackers to log in as LDAP/AD-delegated users by sending a Basic Authorization header with a known username and empty password.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.