LDAP authentication bypass with empty password
Impact
Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider.
Only deployments where LDAP servers are configured to allow unauthenticated binds (eg. default on Active Directory) are affected.
Patches
A fix has been implemented that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. See https://github.com/alerta/alerta/pull/1345
Workarounds
LDAP administrators can disallow unauthenticated bind requests by clients.
References
https://tools.ietf.org/html/rfc4513#section-5.1.2 https://pypi.org/project/alerta-server/8.1.0/
For more information
If you have any questions or comments about this advisory:
- Add a comment to the issue #1277
- Email us at admin@alerta.dev
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | alerta-server | >= 8.0.0, < 8.1.0, < 7.5.7 | 8.1.0, 7.5.7 |
References
- https://github.com/alerta/alerta/issues/1277
- https://pypi.org/project/alerta-server/8.1.0/
- https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh
- https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
- https://tools.ietf.org/html/rfc4513#section-5.1.2
- https://github.com/alerta/alerta/pull/1345
- https://nvd.nist.gov/vuln/detail/CVE-2020-26214
- https://github.com/alerta/alerta
- https://github.com/pypa/advisory-database/tree/main/vulns/alerta-server/PYSEC-2020-159.yaml
- https://pypi.org/project/alerta-server/8.1.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-287- Platform
- Python (PyPI)
- Package
alerta-server- Disclosed
- 06.11.2020
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2020-159 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5hmm-x8q8-w5jh - CC BY 4.0
Vulnerability history: alerta-server
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 11.2020 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
LDAP authentication bypass with empty password this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.