CVE-2026-46619

Open Access Management (OpenAM) versions prior to 16.1.1 contain an LDAP injection flaw (CWE-90) in the MSISDN authentication module: the MSISDNValidation code concatenates the attacker-supplied MSISDN value directly into an LDAP search filter without escaping, and the default empty trusted-gateway list treats all traffic as trusted. An unauthenticated remote attacker who can reach an authentication chain in which an MSISDN module is enabled can submit an MSISDN value containing LDAP filter metacharacters to manipulate the search so it matches an arbitrary user. The module then authenticates against that user, granting the attacker a normal authenticated OpenAM session without ever needing a password. Organizations running OpenAM below 16.1.1 with the MSISDN module enabled in any reachable realm are exposed to full account impersonation and access to everything those users can reach. The issue is fixed in version 16.1.1; there is no known public proof of concept and no evidence of exploitation in the wild, and it is not in the CISA KEV catalog.

What to do: Upgrade to OpenAM 16.1.1 or later, which escapes the MSISDN value before it enters the LDAP filter. If immediate patching is not possible, remove the MSISDN module from all reachable authentication chains or configure the trusted-gateway list so only legitimate gateway source addresses are accepted. Audit authentication and session logs for MSISDN-based logins with malformed values or unexpected user matches, and revoke any sessions established via the MSISDN module on unpatched realms.