{"id":"CVE-2026-41573","kind":"vulnerability","aliases":["CVE-2026-41573","GHSA-2vg8-q4c2-5cw3"],"related":[],"title":"OpenAM has LDAP Injection via `_queryId` Parameter","description":"OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under `/json/{realm}/users`. In `IdentityResourceV1.queryCollection()`, the HTTP query parameter `_queryId` is passed to a `CrestQuery` object with `escapeQueryId` **explicitly set to `false`**, bypassing the escape protection introduced as part of the CVE-2021-29156 fix. The unescaped value flows directly to `DJLDAPv3Repo.getFilter()` where it is concatenated into an LDAP filter string without sanitization, enabling authenticated attackers to inject arbitrary LDAP metacharacters for user enumeration and blind LDAP injection.\n\n## Affected Endpoint\n\n| Endpoint | Auth Required | Injection Parameter |\n|----------|--------------|---------------------|\n| `GET /openam/json/{realm}/users?_queryId=<INJECTION>` | SSO Token | `_queryId` |\n| `GET /openam/json/{realm}/groups?_queryId=<INJECTION>` | SSO Token (TBD) | `_queryId` |\n\n## Background: CVE-2021-29156\n\nCVE-2021-29156 was a pre-authentication LDAP injection in OpenAM's Webfinger endpoint, where user-supplied input reached `DJLDAPv3Repo.getFilter()` unescaped. The fix introduced the `escapeQueryId` flag in `CrestQuery` (defaulting to `true`) and added `Filter.escapeAssertionValue()` in the filter-building path:\n\n## Credit\n\nDiscovered by **JD-Security SHENYI Team**","summary":"OpenAM's CREST user and group query endpoints pass the _queryId parameter into an LDAP filter without escaping, because escaping is explicitly turned off. An authenticated user can inject LDAP metacharacters to enumerate users and run blind LDAP injection against the directory.","severity":"high","cvss":7.1,"epss":0.00496,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-core-rest","fixed":["16.1.1"],"affected":"<= 16.0.6","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-74","cwe-90","identity","java","ldap","openam","package","self-hosted"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Look for the `openam-core-rest` Maven dependency and its version in your build files or `pom.xml`, for example with `mvn dependency:tree | grep openam-core-rest`.\n- Check whether your deployment exposes `/openam/json/{realm}/users` or `/openam/json/{realm}/groups` to users who hold an SSO token.","fix":"- Upgrade `org.openidentityplatform.openam:openam-core-rest` to `16.1.1` or later.\n- Until the upgrade is done, restrict access to the `/json/{realm}/users` and `/json/{realm}/groups` endpoints at the reverse proxy or load balancer.","status":"open","published_at":"2026-06-22T19:59:33+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","triaged_at":"2026-10-28T15:31:04+00:00","updated_at":"2026-10-28T15:33:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:31:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.openidentityplatform.openam:openam-core-rest` to `16.1.1` or later.\n- Until the upgrade is done, restrict access to the `/json/{realm}/users` and `/json/{realm}/groups` endpoints at the reverse proxy or load balancer.","reach":"internet","title":"OpenAM: LDAP injection via _queryId lets authenticated users enumerate directory","impact":"medium","summary":"OpenAM's CREST user and group query endpoints pass the _queryId parameter into an LDAP filter without escaping, because escaping is explicitly turned off. An authenticated user can inject LDAP metacharacters to enumerate users and run blind LDAP injection against the directory.","category":"package","nicknames":[],"who_cares":["openam","identity","self-hosted","java","ldap"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated users enumerate directory accounts and extract LDAP data blindly","analyst_note":"","how_to_check":"- Look for the `openam-core-rest` Maven dependency and its version in your build files or `pom.xml`, for example with `mvn dependency:tree | grep openam-core-rest`.\n- Check whether your deployment exposes `/openam/json/{realm}/users` or `/openam/json/{realm}/groups` to users who hold an SSO token.","needs_analyst":false,"not_affected_if":["fixed-version","auth-required"],"who_is_affected":"Deployments running `openam-core-rest` at version `16.0.6` or earlier that expose the CREST user or group query endpoints. Exploitation requires a valid SSO token, so the risk is highest where many people can log in or self-register. Installations on `16.1.1` or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":3875,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2021':139C,201C,204C '-2026':9A,17A '-29156':140C,202C,205C '-41573':10A,18A '-74':25B '-90':27B '/groups':193C '/json':107C '/openam/json':183C,191C '/users':109C,185C '2vg8':13A '5cw3':15A 'add':238C 'affect':175C 'api':100C 'arbitrari':165C 'attack':162C 'auth':178C 'authent':61B,161C,210C 'background':199C 'blind':72B,172C 'build':244C 'bypass':129C 'capabl':96C 'concaten':152C 'connect':95C 'core':22A 'credit':246C 'crest':38B,98C 'crestqueri':121C,233C 'cve':8A,16A,138C,200C,203C 'cwe':24B,26B 'default':234C 'direct':146C 'directori':77B 'discov':247C 'djldapv3repo.getfilter':148C,224C 'enabl':160C 'endpoint':43B,105C,176C,177C,217C 'enumer':68B,170C 'escap':53B,55B,131C 'escapequeryid':124C,230C 'explicit':57B,125C 'expos':102C 'fals':128C 'filter':51B,156C,243C 'filter-build':242C 'filter.escapeassertionvalue':239C 'fix':141C,227C 'flag':231C 'flow':145C 'get':182C,190C 'ghsa':12A 'ghsa-2vg8-q4c2-5cw3':11A 'group':41B 'host':35B 'http':113C 'iam':87C 'ident':28B,80C 'identityresourcev1.querycollection':111C 'inject':4A,64B,74B,164C,174C,180C,212C 'input':222C 'introduc':133C,228C 'java':29B 'jd':250C 'jd-secur':249C 'layer':101C 'ldap':3A,30B,50B,65B,73B,155C,166C,173C,211C 'metacharact':66B,167C 'oauth2':91C 'object':122C 'open':79C,85C 'open-sourc':84C 'openam':1A,21A,31B,36B,78C,214C 'openam-core-rest':20A 'openid':94C 'org.openidentityplatform.openam':19A 'packag':32B 'paramet':7A,47B,115C,181C 'part':135C 'pass':44B,118C 'path':245C 'platform':81C,88C 'pre':209C 'pre-authent':208C 'protect':132C 'provid':89C 'q4c2':14A 'queri':42B,104C,114C 'queryid':6A,46B,116C,186C,189C,194C,198C 'reach':223C 'realm':108C,184C,192C 'requir':179C 'rest':23A,99C 'run':71B 'saml':92C 'sanit':159C 'secur':251C 'self':34B 'self-host':33B 'set':126C 'shenyi':252C 'sourc':86C 'sso':90C,187C,195C 'string':157C 'suppli':221C 'tbd':197C 'team':253C 'token':188C,196C 'true':236C 'turn':58B 'unescap':143C,225C 'user':39B,62B,69B,103C,169C,220C 'user-suppli':219C 'valu':144C 'via':5A 'webfing':216C 'without':52B,158C","nicknames":[],"mitigations":[],"who_affected":"Deployments running `openam-core-rest` at version `16.0.6` or earlier that expose the CREST user or group query endpoints. Exploitation requires a valid SSO token, so the risk is highest where many people can log in or self-register. Installations on `16.1.1` or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-22T19:59:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2vg8-q4c2-5cw3","url":"https://github.com/advisories/GHSA-2vg8-q4c2-5cw3","severity":"high","published_at":"2026-06-22T19:59:33+00:00","modified_at":"2026-10-28T15:26:06+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","fetched_at":"2026-10-28T15:29:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41573","severity":null,"published_at":"2026-09-15T10:17:03+00:00","modified_at":"2026-09-23T18:21:42+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}