External risk intelligence

OpenAM Authentication Bypass via LDAP Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-46619

The vulnerability exists in an access management solution's authentication module. As an identity provider and gateway service, OpenAM is designed to be public-facing to facilitate user authentication and access control, making this authentication endpoint a primary, internet-reachable interface by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Open Access Management (OpenAM) software that allows unauthenticated remote attackers to gain unauthorized access and obtain a normal authenticated session without a password. The issue arises from improper handling of user-supplied input within the MSISDN authentication module, enabling attackers to inject code that manipulates the system's Lightweight Directory Access Protocol (LDAP) search filters. This could allow an attacker to bypass authentication mechanisms and access protected resources.

Unauthenticated attackers can bypass login.
Critical access control flaw in authentication module.
Confirm relevance and exposure for OpenAM.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component through the network and trigger the vulnerability without needing any credentials. This occurs within the MSISDN authentication module where an improperly handled phone number input allows for an attacker to craft a malicious LDAP query. Successful exploitation could lead to an attacker gaining normal authenticated access to the system.

No authentication required.
Injecting special characters into phone number field.
Gaining session without password.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could inject characters into the MSISDN field to manipulate an LDAP search, potentially bypassing authentication and obtaining a normal session. This could occur when the MSISDN module is enabled and accessible within an authentication chain.

User session access without authentication.
Attacker manipulates MSISDN input to bypass authentication.
Compromised user sessions and access to protected resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this critical vulnerability in the OpenAM access management solution. The first practical step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then locate the accountable owner to plan remediation based on the identified risk.

Identify affected OpenAM instances.
Verify reachability and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenAM?

OpenAM is an access management solution used by organizations to handle user authentication, identity federation, and access control. It acts as a gatekeeper for applications, verifying user identities before granting access to protected systems. Because it serves as a central hub for login requests, it is often placed in highly accessible network locations to ensure users can reach it from anywhere.

What does CWE-90 mean for CVE-2026-46619?

CWE-90 refers to Improper Neutralization of Special Elements used in an LDAP Query. In the context of this CVE, it means the software fails to sanitize input before using it in a database command. An attacker can use this weakness to inject malicious characters into a search filter, effectively tricking the system into misinterpreting their input as a legitimate query and allowing them to bypass the intended security checks.

How is this authentication bypass triggered?

The vulnerability is triggered by submitting a specifically crafted MSISDN value—typically a phone number—into the authentication module. The system processes this input and injects it directly into an LDAP query. The attack only succeeds if the MSISDN authentication module is actively enabled and included in a reachable authentication chain; if this specific module is not in use, the vulnerability cannot be triggered through this path.

Is my OpenAM instance relevant to this threat?

If you are running OpenAM, your instance is likely relevant. According to Halo Surface Signal, this software is designed to be public-facing to facilitate user authentication, meaning it is often directly accessible from the internet by design. Because this flaw allows for unauthenticated access, any instance with the MSISDN module enabled that is reachable over the network should be considered a potential target for this activity.

What is the first step to fix this?

The immediate priority is to identify all deployed versions of OpenAM within your infrastructure to determine if they are older than 16.1.1. Once you have located these instances, verify whether the vulnerable MSISDN authentication module is enabled. If it is in use, coordinate with your platform teams to plan an update to version 16.1.1 or higher, which includes the necessary sanitization logic to prevent LDAP injection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.