https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T17:15:23.237663+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-46619 fkie_cve-2026-46619 2026-09-29T17:15:23.440184+00:00

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.

 https://vulnerability.circl.lu/vuln/ghsa-xq73-fvmr-jvmm GHSA-xq73-fvmr-jvmm — OpenAM Authentication Bypass via MSISDN LDAP Injection 2026-09-29T17:15:23.440293+00:00

Affected: Maven: org.openidentityplatform.openam:openam-auth-msisdn

## Summary

**Description**

An LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacker to obtain an arbitrary OpenAM session without a password in the default trusted gateway configuration. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

## Impact OpenAM deployments through version 16.0.6 that have MSISDN enabled are potentially affected. This enables a pre-authentication login bypass for any realm where an MSISDN module instance is enabled in an authentication chain and reachable through the trusted-gateway list, which allows all traffic by default. The request-supplied MSISDN value was concatenated directly into an LDAP search filter. The resulting OpenAM session is a normal authenticated session for the matched user.

## Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-46619 UBUNTU-CVE-2026-46619 2026-09-29T17:15:23.440365+00:00

Affected: Ubuntu:16.04:LTS: openam

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.