CVE-2026-41573 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Open Access Management (OpenAM) prior to version 16.1.1 represents a critical failure in input validation and sanitization mechanisms, specifically affecting the IdentityResourceV1.queryCollection endpoint. This component is responsible for handling user queries via the /json/{realm}/users API path. The core technical flaw lies in how the _queryId parameter is processed when passed to the CrestQuery module with the escapeQueryId flag disabled. Although previous security patches attempted to address similar issues, such as those related to CVE-2021-29156, this specific code path remained unprotected due to a configuration or logic oversight that allowed unescaped input to propagate further into the backend systems without adequate filtering.
The operational impact of this flaw is severe because it enables blind LDAP injection attacks against authenticated users. Once the malicious _queryId value bypasses the initial API layer and reaches the DJLDAPv3Repo.getFilter() method, it is directly concatenated into an LDAP filter string used for directory service queries. Because the input is not sanitized to remove or escape special characters, an attacker can inject LDAP metacharacters such as parentheses, asterisks, and ampersands. This capability allows the attacker to manipulate the structure of the LDAP query sent to the underlying identity store, typically Active Directory or OpenLDAP.
From a security classification perspective, this vulnerability aligns with CWE-90 for Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as Injection, specifically adapted here for Lightweight Directory Access Protocol contexts. It also maps closely to MITRE ATT&CK technique T1203, which covers Exploitation for Credential Access and Information Discovery. The primary consequence is user enumeration, where the attacker can determine the existence of specific users or groups by observing differences in application responses based on whether a queried entity exists in the directory. In more advanced scenarios, blind LDAP injection could potentially be leveraged to extract sensitive data from the identity store if time-based or error-based extraction techniques are employed, although user enumeration is the most immediate and reliable outcome given the typical response patterns of such systems.
Mitigation for this vulnerability requires an immediate upgrade to OpenAM version 16.1.1 or later, where the issue has been resolved by ensuring that all inputs passed to query functions are properly escaped regardless of the escapeQueryId flag status. For organizations unable to patch immediately due to operational constraints, a temporary workaround involves implementing strict input validation at the network perimeter using Web Application Firewalls (WAF) rules designed to detect and block LDAP metacharacters within JSON payloads targeting user endpoints. Additionally, enforcing least-privilege access controls on API endpoints can limit the blast radius if an attacker gains initial authenticated access, ensuring that only necessary roles are permitted to invoke query collection functions.