Access Management Solution Vulnerability in OpenAM by OpenIdentity Platform

CVE-2026-41573

What is CVE-2026-41573?

OpenAM, an access management solution by OpenIdentity Platform, has a security vulnerability that arises from the handling of the _queryId parameter in the IdentityResourceV1.queryCollection() method. Specifically, in versions prior to 16.1.1, the lack of proper escaping for this parameter allows authenticated attackers to perform LDAP injection. This can lead to unauthorized user enumeration or other malicious actions as the unescaped input is used in an LDAP filter. This vulnerability has been addressed in version 16.1.1, which includes enhanced security measures.

References