CVE-2026-41573
Received Received - Intake

LDAP Injection in OpenAM Prior to 16.1.1

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-41573
EUVD
EUVD-2026-78366

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam 16.1.1
openidentityplatform openam to 16.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41573 is an LDAP injection vulnerability in OpenAM, an access management solution. It occurs because the _queryId parameter from /json/{realm}/users is passed to CrestQuery without proper escaping. This bypasses a previous fix (CVE-2021-29156) and allows attackers to inject LDAP metacharacters into queries. The flaw enables user enumeration and blind LDAP injection attacks.

Detection Guidance

To detect this vulnerability, monitor LDAP query logs for unusual patterns or unexpected characters in the _queryId parameter of requests to /json/{realm}/users. Check for user enumeration attempts or blind LDAP injection signs like excessive failed queries or unusual filter syntax. Use tools like Wireshark or tcpdump to inspect network traffic for suspicious LDAP query modifications.

Impact Analysis

An attacker with an SSO token could exploit this to manipulate LDAP queries, potentially accessing unauthorized data or executing arbitrary LDAP commands. This may lead to unauthorized user enumeration, data exposure, or further system compromise depending on the LDAP directory contents.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if personal or sensitive data is compromised through LDAP injection attacks.

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.1 or later to apply the patch. If upgrading is not possible, disable the affected /json/{realm}/users endpoint or restrict access to authenticated users only. Implement input validation to sanitize the _queryId parameter before processing LDAP queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart