[security] prevent otp bypass when LdapAuth.mixedAuth=true and Security.require_otp=true
fix: [security] prevent otp bypass when LdapAuth.mixedAuth=true and Security.require_otp=true
[security] prevent otp bypass when LdapAuth.mixedAuth=true and Security.require_otp=true39b3cb-fix-security-prevent-otp-bypass-when-ldapauth-cve-2026-10611fixsecurity prevent otp bypass ldapauth mixedauth
Committed by righel
commit message
fix: [security] prevent otp bypass when LdapAuth.mixedAuth=true and Security.require_otp=trueEditor assessment
This commit patches CVE-2026-10611. The subject, fix: [security] prevent otp bypass when LdapAuth.mixedAuth=true and Security.require_otp=true, is unusually specific about the configuration combination that triggered the bypass, which aids triage. The drawback is length: roughly a hundred characters, well past the usual seventy-two and closer to a paragraph than a header. There is no body at all, so the flawed control flow and the code change are undocumented, and [security] is a label rather than a scope naming a code section. Specific but overlong and unexplained summarizes the result.