CVE-2026-41573

OpenAM (Open Access Management) versions prior to 16.1.1 contain an LDAP injection flaw (CWE-90) in IdentityResourceV1.queryCollection(), which passes the _queryId parameter from the //{realm}/users REST endpoint to CrestQuery with escapeQueryId disabled, silently bypassing the protection added for CVE-2021-29156. The unescaped value is concatenated into an LDAP filter inside DJLDAPv3Repo.getFilter(), so any authenticated (low-privileged) user can supply LDAP metacharacters to manipulate the filter sent to the backing directory. This enables user/account enumeration and blind LDAP injection, letting an attacker infer directory contents and potentially extract sensitive user attributes through crafted queries. Organizations running OpenAM below 16.1.1 with the users query endpoint reachable to authenticated users are affected, and the issue is fixed in version 16.1.1. No public proof-of-concept exists and the flaw is not in CISA's KEV, so exploitation is currently none known.

What to do: Upgrade to OpenAM 16.1.1, which fixes the escapeQueryId bypass in the users queryCollection path. Until patched, restrict which authenticated principals can issue queries against //{realm}/users and monitor access logs for _queryId values containing LDAP metacharacters (parentheses, asterisks, backslashes), which would indicate enumeration or blind injection attempts. If you run a downstream fork of OpenAM rather than the upstream project, verify the maintainer has applied the equivalent fix, since the original CVE-2021-29156 hardening is insufficient on its own.