CVE-2026-46619: Open Identity Platform OpenAM LDAP injection in MSISDN module

Executive brief

A security flaw in OpenAM, an identity and access management platform, allows unauthorized individuals to bypass login screens and gain full access to user accounts. By sending a specially crafted request to a specific mobile-related login module, an attacker can trick the system into granting them a valid session without requiring a password. This could lead to unauthorized access to sensitive corporate applications and data protected by the OpenAM service.

Technical details

An LDAP Injection (CWE-90) vulnerability exists in the MSISDN authentication module of OpenAM Community Edition. The root cause is the direct concatenation of the request-supplied MSISDN value into an LDAP search filter without proper sanitization. In environments using the default trusted gateway configuration, an unauthenticated remote attacker can exploit this via the network to perform a login bypass. Successful exploitation results in a normal authenticated session for the targeted user. The issue is fixed in version 16.1.1.

Affected products

• Open Identity Platform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-26: advisory: GitHub Advisory GHSA-xq73-fvmr-jvmm published
• 2026-06-26: patched: OpenAM Community Edition 16.1.1 released

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D