Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55167— LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session

Quick assessment

Affected
LDAPAccountManager lam
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LDAP 账户管理器（LAM）是一个用于管理存储在 LDAP 目录中的条目（例如用户、组、DHCP 设置等）的 Web 前端界面。在 9.6 版本之前，启用了 WebAuthn 双因素认证的 LAM 安装中，在成功处理认证响应后，WebAuthn 的挑战（challenge）状态仍保留在同一 PHP 会话中。这意味着，如果一个用户已经通过了有效的密码认证，他/她可以重复使用同一个已经签名过的 WebAuthn 认证状态，而不是将其一次性消耗掉。 不过，该漏洞的实际风险受到以下几个条件的限制：攻击者必须拥有有效的密码

CVSS 4.2 · Medium EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
LDAPAccountManager lam < 9.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55167

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
Source: CVE Program / CVE List V5
Vulnerability Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LDAPAccountManager lam < 9.6 -

II. Public POCs for CVE-2026-55167

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55167

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55167 (1)

Other References for CVE-2026-55167 (2)

IV. Related Vulnerabilities

Same product: lam
Same vendor: LDAPAccountManager
Same weakness: CWE-294

V. Comments for CVE-2026-55167

No comments yet

Leave a comment