CVE-2024-26268

@@ -5610,7 +5610,11 @@ else if (authType.equals(CompanyConstants.AUTH_TYPE_ID)) {
 		}
 
 		if (user == null) {
-			PwdAuthenticator.pretendToAuthenticate();
+			if ((authResult == Authenticator.SUCCESS) &&
+				PropsValues.AUTH_PIPELINE_ENABLE_LIFERAY_CHECK) {
+
+				PwdAuthenticator.pretendToAuthenticate();
+			}
 
 			return Authenticator.DNE;
 		}

@@ -88,7 +88,29 @@ else if (GetterUtil.getBoolean(
 		return false;
 	}
 
+	public static void pretendToAuthenticate() throws PwdEncryptorException {
+		authenticate(
+			_PRETENDED_LOGIN, _PRETENDED_CLEAR_TEXT_PASSWORD,
+			_PRETENDED_CURRENT_ENCRYPTED_PASSWORD);
+	}
+
+	private static final String _PRETENDED_CLEAR_TEXT_PASSWORD = "password";
+
+	private static final String _PRETENDED_CURRENT_ENCRYPTED_PASSWORD;
+
+	private static final String _PRETENDED_LOGIN = "login";
+
 	private static final Log _log = LogFactoryUtil.getLog(
 		PwdAuthenticator.class.getName());
 
+	static {
+		try {
+			_PRETENDED_CURRENT_ENCRYPTED_PASSWORD =
+				PasswordEncryptorUtil.encrypt("currentPassword");
+		}
+		catch (PwdEncryptorException pwdEncryptorException) {
+			throw new RuntimeException(pwdEncryptorException);
+		}
+	}
+
 }
\ No newline at end of file

@@ -5610,6 +5610,8 @@ else if (authType.equals(CompanyConstants.AUTH_TYPE_ID)) {
 		}
 
 		if (user == null) {
+			PwdAuthenticator.pretendToAuthenticate();
+
 			return Authenticator.DNE;
 		}