Had the same issue, looks like this is related to the existing demo config that overrode main config parameters:
https://github.com/opensearch-project/security/pull/4793
The fix was added to the version 2.18.0