OpenAM Authentication Bypass via MSISDN LDAP Injection

CRITICO 9.3CVE-2026-46619 · GHSA-xq73-fvmr-jvmm · Published 15/09/2026 · updated 25/09/2026

In breve

CVE-2026-46619 è una vulnerabilità CRITICO (CVSS 9.3) che riguarda org.openidentityplatform.openam:openam-auth-msisdn.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.99%, superiore al 62.6% delle vulnerabilità.
Correzione: aggiornare a 16.1.1 o successiva.

Package	Affected versions	Patched versions
org.openidentityplatform.openam:openam-auth-msisdn Maven	`< 16.1.1`	`16.1.1`

Description

Summary

Description

An LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacker to obtain an arbitrary OpenAM session without a password in the default trusted gateway configuration. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

Impact

OpenAM deployments through version 16.0.6 that have MSISDN enabled are potentially affected. This enables a pre-authentication login bypass for any realm where an MSISDN module instance is enabled in an authentication chain and reachable through the trusted-gateway list, which allows all traffic by default. The request-supplied MSISDN value was concatenated directly into an LDAP search filter. The resulting OpenAM session is a normal authenticated session for the matched user.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

NVD description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.

References

OpenIdentityPlatform/OpenAM security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-46619 · ADVISORY
OpenIdentityPlatform/OpenAM commit 9814d51 · WEB
OpenIdentityPlatform/OpenAM · PACKAGE
OpenIdentityPlatform/OpenAM release 16.1.1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.openidentityplatform.openam:openam-auth-msisdn

Maven

< 16.1.1

16.1.1