CVE-2026-46619 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within the ForgeRock Access Management solution, formerly known as OpenAM, represents a critical authentication bypass rooted in improper input validation and insecure configuration defaults. Specifically affecting versions prior to 16.1.1, this flaw resides within the MSISDN authentication module's handling of mobile subscriber identification numbers during the login process. The core technical deficiency is an LDAP injection vulnerability where the application concatenates user-supplied MSISDN values directly into an LDAP search filter without performing any sanitization or escaping operations. This lack of input validation allows a remote attacker to manipulate the structure of the LDAP query, effectively bypassing standard authentication mechanisms that would normally require valid credentials such as passwords.
The operational impact of this vulnerability is severe because it enables unauthenticated access to the system under specific conditions. For an attack to be successful, two primary factors must align: the MSISDN module must be enabled and present in a reachable authentication chain within the targeted realm, and the server configuration must retain its default settings regarding trusted gateways. The default empty list for trusted-gateway identifiers means that by default, all incoming traffic is considered trustworthy from an infrastructure perspective, removing any network-level restrictions that might otherwise limit exposure to internal networks only. Consequently, a remote attacker can exploit this misconfiguration over the public internet if the service is exposed.
By injecting LDAP metacharacters into the MSISDN field, an attacker can alter the logic of the search filter. This manipulation allows them to select arbitrary users within the directory and obtain a valid authenticated session token without possessing the corresponding password or other authentication factors. This effectively nullifies the security controls provided by the identity provider, granting the attacker full administrative privileges associated with the targeted user account. Such unauthorized access can lead to data exfiltration, privilege escalation, lateral movement within the network, and complete compromise of sensitive organizational resources protected by this access management layer.
From a classification standpoint, this vulnerability aligns with CWE-90, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection, but applied here to Lightweight Directory Access Protocol queries. It also maps closely to CWE-78, Improper Neutralization of Special Elements used in an OS Command, depending on the specific implementation details of how the LDAP filter is processed internally by the application server. In terms of offensive security tactics, this exploit corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or authentication mechanisms to gain initial access and maintain persistence within a target environment without triggering typical intrusion detection alerts associated with brute-force attacks.
Mitigation strategies must address both the software versioning and the configuration posture of the deployment. The primary remediation is to upgrade the OpenAM instance to version 16.1.1 or later, where the code has been patched to properly escape special characters in user-supplied input before it is incorporated into LDAP search filters. Additionally, organizations should review their authentication chains to ensure that sensitive modules like MSISDN are not enabled unless strictly necessary for business operations. It is also critical to configure the trusted-gateway list explicitly rather than relying on the default empty state, thereby restricting which IP addresses or hostnames can initiate these specific authentication flows. Implementing web application firewalls with rules specifically designed to detect LDAP injection patterns can provide an additional layer of defense in depth while patching efforts are underway.