{"id":"CVE-2026-46619","kind":"vulnerability","aliases":["CVE-2026-46619","GHSA-xq73-fvmr-jvmm"],"related":[],"title":"OpenAM Authentication Bypass via MSISDN LDAP Injection","description":"## Summary\n\n**Description**\n\nAn LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacker to obtain an arbitrary OpenAM session without a password in the default trusted gateway configuration. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.\n\n## Impact\nOpenAM deployments through version 16.0.6 that have MSISDN enabled are potentially affected. This enables a pre-authentication login bypass for any realm where an MSISDN module instance is enabled in an authentication chain and reachable through the trusted-gateway list, which allows all traffic by default. The request-supplied MSISDN value was concatenated directly into an LDAP search filter. The resulting OpenAM session is a normal authenticated session for the matched user.\n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.","summary":"The MSISDN authentication module concatenates a request-supplied value directly into an LDAP search filter, so an unauthenticated remote attacker can inject filter syntax. A successful injection yields a normal authenticated OpenAM session for the matched user without a password.","severity":"critical","cvss":9.3,"epss":0.00992,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-auth-msisdn","fixed":["16.1.1"],"affected":"< 16.1.1","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["authentication","cwe-1188","cwe-90","java","openam","package","self-hosted"],"not_affected_if":["msisdn-disabled","restricted-trusted-gateway"],"how_to_check":"- Check the OpenAM version in use: `openam-auth-msisdn` below `16.1.1` is affected.\n- Check whether an MSISDN module instance is enabled in any authentication chain, and whether the trusted-gateway list reaches it (the default trusts all traffic).","fix":"- Upgrade `openam-auth-msisdn` (OpenAM Community Edition) to `16.1.1` or later.\n- Until upgraded, disable the MSISDN authentication module in authentication chains or restrict the trusted-gateway list.","status":"open","published_at":"2026-06-26T17:32:18+00:00","first_seen_at":"2026-10-28T15:34:52+00:00","triaged_at":"2026-10-28T15:35:13+00:00","updated_at":"2026-10-28T16:04:30+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:35:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `openam-auth-msisdn` (OpenAM Community Edition) to `16.1.1` or later.\n- Until upgraded, disable the MSISDN authentication module in authentication chains or restrict the trusted-gateway list.","reach":"internet","title":"OpenAM: MSISDN LDAP injection lets unauthenticated users obtain sessions","impact":"high","summary":"The MSISDN authentication module concatenates a request-supplied value directly into an LDAP search filter, so an unauthenticated remote attacker can inject filter syntax. A successful injection yields a normal authenticated OpenAM session for the matched user without a password.","category":"package","nicknames":[],"who_cares":["openam","self-hosted","java","authentication"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker logs in as any matched user without a password","analyst_note":"","how_to_check":"- Check the OpenAM version in use: `openam-auth-msisdn` below `16.1.1` is affected.\n- Check whether an MSISDN module instance is enabled in any authentication chain, and whether the trusted-gateway list reaches it (the default trusts all traffic).","needs_analyst":false,"not_affected_if":["msisdn-disabled","restricted-trusted-gateway"],"who_is_affected":"Deployments of OpenAM Community Edition through `16.0.6` that have an MSISDN module instance enabled in an authentication chain reachable through the trusted-gateway list. The default trusted-gateway configuration allows all traffic, so default-configured deployments with MSISDN enabled are exposed. Deployments without MSISDN enabled are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":3608,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1188':26B '-2026':9A,17A '-46619':10A,18A '-90':28B,82C '16.0.6':116C,129C '16.1.1':123C,210C 'affect':136C 'allow':89C,168C 'arbitrari':97C 'attack':55B,93C 'auth':22A 'authent':2A,24B,37B,66B,87C,142C,157C,194C 'bypass':3A,144C 'chain':158C 'communiti':112C,207C 'concaten':39B,180C 'configur':108C 'cve':8A,16A 'cwe':25B,27B,81C 'default':105C,172C 'deploy':126C 'descript':77C 'direct':45B,181C 'edit':113C,208C 'enabl':133C,138C,154C 'encourag':213C 'filter':50B,58B,186C 'fvmr':14A 'gateway':107C,165C 'ghsa':12A 'ghsa-xq73-fvmr-jvmm':11A 'host':34B 'impact':110C,124C 'inject':7A,57B,62B,80C 'instanc':152C 'issu':118C 'java':29B 'jvmm':15A 'latest':218C 'ldap':6A,48B,79C,184C 'list':166C 'login':143C 'match':71B,198C 'modul':38B,88C,151C 'msisdn':5A,23A,36B,86C,132C,150C,177C 'normal':65B,193C 'obtain':95C 'openam':1A,21A,30B,67B,98C,111C,125C,189C,206C 'openam-auth-msisdn':20A 'org.openidentityplatform.openam':19A 'packag':31B 'password':75B,102C 'patch':120C,200C,204C 'potenti':135C 'pre':141C 'pre-authent':140C 'reachabl':160C 'realm':147C 'releas':219C 'remot':54B,92C 'request':42B,175C 'request-suppli':41B,174C 'result':188C 'search':49B,185C 'self':33B 'self-host':32B 'session':68B,99C,190C,195C 'success':61B 'summari':76C 'suppli':43B,176C 'syntax':59B 'traffic':170C 'trust':106C,164C 'trusted-gateway':163C 'unauthent':53B,91C 'updat':215C 'user':72B,199C,211C 'valu':44B,178C 'version':115C,122C,128C,209C 'via':4A 'vulner':83C 'without':73B,100C 'xq73':13A 'yield':63B","nicknames":[],"mitigations":[],"who_affected":"Deployments of OpenAM Community Edition through `16.0.6` that have an MSISDN module instance enabled in an authentication chain reachable through the trusted-gateway list. The default trusted-gateway configuration allows all traffic, so default-configured deployments with MSISDN enabled are exposed. Deployments without MSISDN enabled are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-26T17:32:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xq73-fvmr-jvmm","url":"https://github.com/advisories/GHSA-xq73-fvmr-jvmm","severity":"high","published_at":"2026-06-26T17:32:18+00:00","modified_at":"2026-10-28T15:29:48+00:00","first_seen_at":"2026-10-28T15:34:52+00:00","fetched_at":"2026-10-28T15:34:52+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46619","severity":null,"published_at":"2026-09-15T10:17:04+00:00","modified_at":"2026-09-25T14:23:59+00:00","first_seen_at":"2026-10-28T16:04:30+00:00","fetched_at":"2026-10-28T16:04:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}