CVE-2026-55167

Deferred Deferred - Pending Action

LDAP Account Manager WebAuthn Session Reuse Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55167

EUVD

EUVD-2026-101595

Affected Vendors & Products

Vendor	Product	Version / Range
LDAPAccountManager	lam	< 9.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

LDAP Account Manager (LAM) prior to version 9.6 had a flaw in its WebAuthn two-factor authentication. After a user completes password authentication, the WebAuthn challenge remained stored in the PHP session instead of being cleared. This allowed the same signed WebAuthn state to be reused, though only if the attacker had valid password access and shared the same session.

Detection Guidance

To detect this vulnerability, check if your LDAP Account Manager (LAM) version is below 9.6. Verify the WebAuthn session handling by inspecting PHP session variables for 'webauthn_authentication' persistence after authentication. Review logs for unusual WebAuthn challenge reuse attempts.

Impact Analysis

The impact is limited but not zero. An attacker who already knows your password could potentially reuse a valid WebAuthn challenge if they share the same PHP session. This requires prior password compromise and session access, reducing the practical risk but not eliminating it entirely.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it requires prior valid password authentication and session access. The risk is limited by the need for a valid authenticator signature and session retention, which does not involve unauthorized data exposure or processing of sensitive personal data.

Mitigation Strategies

Upgrade LDAP Account Manager to version 9.6 or later to apply the security fix. Ensure PHP sessions are properly cleared after WebAuthn authentication. Monitor for any suspicious activity related to WebAuthn challenges in session data.

Hi! I’m here to help you understand CVE-2026-55167. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70