CVE-2026-41573— OpenAM LDAP Injection via `_queryId` Parameter
Quick assessment
Affected
OpenIdentityPlatform OpenAM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenAM 是一款访问管理解决方案。在 16.1.1 版本之前， 方法将来自 端点的 参数直接传递给 ，且未对 进行转义处理（ 被禁用），从而绕过了此前为修复 CVE-2021-29156 所添加的保护机制。未经转义的值会传递到 中，并被直接拼接进 LDAP 过滤器中，使得经过身份验证的攻击者可以注入 LDAP 元字符，从而实现用户枚举和盲 LDAP 注入攻击。该问题已在 16.1.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41573
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenAM LDAP Injection via `_queryId` Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.1 | - |
|
II. Public POCs for CVE-2026-41573
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41573
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-41573 (1)
Vendor Advisories for CVE-2026-41573 (1)
Vendor Pages for CVE-2026-41573 (1)
Same Patch Batch · OpenIdentityPlatform · 2026-09-15 · 18 CVEs total
| CVE-2026-62379 | 9.8 CRITICAL | OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCust |
| CVE-2026-46619 | 9.3 CRITICAL | OpenAM Authentication Bypass via MSISDN LDAP Injection |
| CVE-2026-45052 | 9.3 CRITICAL | OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery |
| CVE-2026-45051 | 9.2 CRITICAL | OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage |
| CVE-2026-62263 | 9.2 CRITICAL | OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass |
| CVE-2026-48717 | 9.1 CRITICAL | OpenAM OAuth Authorization Bypass via PKCE Challenge |
| CVE-2026-45048 | 8.5 HIGH | OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC |
| CVE-2026-44203 | 8.3 HIGH | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state paramete |
| CVE-2026-45794 | 7.7 HIGH | OpenAM Unsafe Java Deserialization via SNS |
| CVE-2026-47426 | 7.6 HIGH | OpenAM OAuth Client Impersonation via JWKS Resolver Cache |
| CVE-2026-46498 | 7.6 HIGH | OpenAM Arbitrary OAuth Token Minting via Push Registration |
| CVE-2026-47424 | 7.5 HIGH | OpenAM Authenticated RCE via Groovy Sandbox Escape |
| CVE-2026-53660 | 7.4 HIGH | OpenAM Insecure SSO Cookie Initialization |
| CVE-2026-46623 | 7.4 HIGH | OpenAM Account Takeover via Unverified Password Change in OAuth2 Module |
| CVE-2026-44793 | 7.0 HIGH | OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `F |
| CVE-2026-62280 | 6.1 MEDIUM | OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page |
| CVE-2026-44202 | 5.3 MEDIUM | OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` |
IV. Related Vulnerabilities
Same product: OpenAM
-
CVE-2026-48717
OpenAM OAuth Authorization Bypass via PKCE Challenge -
CVE-2026-47426
OpenAM OAuth Client Impersonation via JWKS Resolver Cache -
CVE-2026-47424
OpenAM Authenticated RCE via Groovy Sandbox Escape -
CVE-2026-62280
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page -
CVE-2026-45051
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Aut
Same vendor: OpenIdentityPlatform
-
CVE-2026-48717
OpenAM OAuth Authorization Bypass via PKCE Challenge -
CVE-2026-47426
OpenAM OAuth Client Impersonation via JWKS Resolver Cache -
CVE-2026-47424
OpenAM Authenticated RCE via Groovy Sandbox Escape -
CVE-2026-62280
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page -
CVE-2026-45051
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Aut
Same weakness: CWE-90
-
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection -
CVE-2026-80055
Dell Secure Connect Gateway 输入验证错误漏洞 -
CVE-2026-78579
Improper Input Sanitization in Okta Access Gateway LDAP Data -
CVE-2026-81205
LDAP / Active Directory Integration - Moderately critical - -
CVE-2026-75020
Apache APISIX: ldap-auth plugin cross-subtree identity imper
V. Comments for CVE-2026-41573
No comments yet