Live › vulnerability › CVE-2026-41573
Go to dashboardOpenAM's CREST user and group query endpoints pass the _queryId parameter into an LDAP filter without escaping, because escaping is explicitly turned off. An authenticated user can inject LDAP metacharacters to enumerate users and run blind LDAP injection against the directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Deployments running openam-core-rest at version 16.0.6 or earlier that expose the CREST user or group query endpoints. Exploitation requires a valid SSO token, so the risk is highest where many people can log in or self-register. Installations on 16.1.1 or later are not affected by this issue.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-core-rest | maven | <= 16.0.6 | 16.1.1 |
openam-core-rest Maven dependency and its version in your build files or pom.xml, for example with mvn dependency:tree | grep openam-core-rest./openam/json/{realm}/users or /openam/json/{realm}/groups to users who hold an SSO token.org.openidentityplatform.openam:openam-core-rest to 16.1.1 or later./json/{realm}/users and /json/{realm}/groups endpoints at the reverse proxy or load balancer.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under /json/{realm}/users. In IdentityResourceV1.queryCollection(), the HTTP query parameter _queryId is passed to a CrestQuery object with escapeQueryId explicitly set to false, bypassing the escape protection introduced as part of the CVE-2021-29156 fix. The unescaped value flows directly to DJLDAPv3Repo.getFilter() where it is concatenated into an LDAP filter string without sanitization, enabling authenticated attackers to inject arbitrary LDAP metacharacters for user enumeration and blind LDAP injection.
| Endpoint | Auth Required | Injection Parameter |
|---|---|---|
GET /openam/json/{realm}/users?_queryId=<INJECTION> | SSO Token | _queryId |
GET /openam/json/{realm}/groups?_queryId=<INJECTION> | SSO Token (TBD) | _queryId |
CVE-2021-29156 was a pre-authentication LDAP injection in OpenAM's Webfinger endpoint, where user-supplied input reached DJLDAPv3Repo.getFilter() unescaped. The fix introduced the escapeQueryId flag in CrestQuery (defaulting to true) and added Filter.escapeAssertionValue() in the filter-building path:
Discovered by JD-Security SHENYI Team
This page as .md · .json · in your agent: get_signal("CVE-2026-41573")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.