CVE-2026-46619: Open Identity Platform OpenAM LDAP injection in MSISDN module

CVE-2026-46619 · Severity: high · CVSS 4 · Published 2026-09-15

A security flaw in OpenAM, an identity and access management platform, allows unauthorized individuals to bypass login screens and gain full access to user accounts. By sending a specially crafted request to a specific mobile-related login module, an attacker can trick the system into granting them a valid session without requiring a password. This could lead to unauthorized access to sensitive corporate applications and data protected by the OpenAM service.

Technologies: Open Identity Platform OpenAM Community Edition. Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-46619 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46619 being exploited in the wild.
How severe is CVE-2026-46619?
High severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
org.openidentityplatform.openam:openam-auth-msisdn (Maven) < 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.1; Open Identity Platform OpenAM Community Edition <= 16.0.6.
Is there a fix for CVE-2026-46619?
Yes. org.openidentityplatform.openam:openam-auth-msisdn (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46619 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46619?
Check whether you run org.openidentityplatform.openam:openam-auth-msisdn (Maven) or Open Identity Platform OpenAM Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.openidentityplatform.openam:openam-auth-msisdn (Maven): upgrade to 16.1.1 or later
    # set org.openidentityplatform.openam:openam-auth-msisdn to 16.1.1 in your pom.xml or build.gradle

Technical details

An LDAP Injection (CWE-90) vulnerability exists in the MSISDN authentication module of OpenAM Community Edition. The root cause is the direct concatenation of the request-supplied MSISDN value into an LDAP search filter without proper sanitization. In environments using the default trusted gateway configuration, an unauthenticated remote attacker can exploit this via the network to perform a login bypass. Successful exploitation results in a normal authenticated session for the targeted user. The issue is fixed in version 16.1.1.

Affected products

  • Open Identity Platform OpenAM Community Edition <= 16.0.6

Identifiers

  • CVE-2026-46619
  • GHSA-xq73-fvmr-jvmm

Timeline

  • 2026-06-26: advisory: GitHub Advisory GHSA-xq73-fvmr-jvmm published
  • 2026-06-26: patched: OpenAM Community Edition 16.1.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.