by Kastro
Paper/Archive/CVE-2026-46619

CVE-2026-46619

OpenIdentityPlatform OpenAM — OpenAM Authentication Bypass via MSISDN LDAP Injection

EPSS 1.0%CVSS 9.3
critical.is priorityof 100
40
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 62.6.626 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.

Affected

ProductAffectedFixed inSource
OpenAM< 16.1.1–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-xq73-fvmr-jvmmrefgithub.com/OpenIdentityPlatform/OpenAM/commit/9814d51f578341e012e4def9dc936e00dd1ce913refgithub.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1