← Back to the live CVE advisory feed

CVE-2026-46619: OpenAM

Severity

9.3 (CRITICAL)

Vendor

OPENIDENTITYPLATFORM

Affected versions

< 16.1.1

Fixed version

16.1.1.

Patch status

Patched

Published

2026-09-15T10:17:04.770

Modified

2026-09-15T15:17:15.700

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.

View the official NVD record for CVE-2026-46619

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.