Access Management Solution Vulnerability in OpenAM by OpenIdentityPlatform

CVE-2026-46619

What is CVE-2026-46619?

A critical vulnerability exists in the MSISDN authentication module of OpenAM, an access management solution. The MSISDNValidation function improperly concatenates user-supplied MSISDN values into an LDAP search filter without adequate escaping. This flaw can be exploited by an unauthenticated attacker who is able to reach the authentication chain, allowing them to inject LDAP filter metacharacters. Ultimately, this enables the attacker to select an arbitrary user and gain unauthorized access to an authenticated OpenAM session without needing a password. This security issue has been addressed in version 16.1.1 of OpenAM.

References