Teedy LDAP Injection Vulnerability Allowing Account Creation and Password Spraying

A vulnerability allowing LDAP injection has been identified in Teedy versions 1.9 to 1.12, when LDAP connection is enabled. The issue arises from inadequate sanitization of user input in the username field of the login form. This flaw allows an unauthenticated attacker to manipulate LDAP queries, potentially leading to the creation of arbitrary user accounts and password spraying attacks.

Impact

Exploitation of this vulnerability could result in unauthorized account creation and password spraying, increasing the risk of unauthorized access to user accounts.