CVE-2026-111347 Details

A vulnerability exists in go-ldap-admin versions through 0.6.2, where a hard-coded RSA private key is embedded in the application and published in a public repository. This key is used to decrypt login passwords that are encrypted with the corresponding public key. Unauthenticated attackers who capture these encrypted passwords can use the private key to decrypt them offline or through the /base/decryptpwd endpoint, thereby recovering cleartext LDAP credentials. Additionally, the application allows for unauthenticated password resets on LDAP accounts, further exploiting the vulnerability.

Remove the hard-coded private key from the application, and instead generate a unique RSA key pair for each deployment. This key pair should be stored securely and not embedded in the binary. Additionally, the application should be updated to use a more secure method of generating verification codes for password resets, such as using cryptographic random number generators, and to implement rate limiting and logging for password reset requests.