{"id":"CVE-2026-41573","summary":"OpenAM LDAP Injection via `_queryId` Parameter","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.","aliases":["GHSA-2vg8-q4c2-5cw3"],"modified":"2026-09-17T08:04:57.642669Z","published":"2026-09-15T09:55:47.049Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-90"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41573.json"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41573.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2vg8-q4c2-5cw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41573"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"d3d86c951a4c3c353719b761ea0b4be80f9dd241"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["148873415345292995920220176731021699011","76222396805107165997157291155862804806","142108032446717725291761617605350208033","328635096903672697365584786074280074919","299908589561052248395696936815071570241","84024353786313360773794069155409289644","211967746553360789069774046210401782238","108192862725389130239802425989034938092"],"threshold":0.9},"id":"CVE-2026-41573-05f02b2a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-shared/src/main/java/org/forgerock/openam/utils/CrestQuery.java"}},{"target":{"file":"openam-datastore/src/test/java/org/forgerock/openam/idrepo/ldap/GenericRepoTest.java","function":"getSearchFilter"},"deprecated":false,"digest":{"function_hash":"168788745286863495558455098638381197658","length":1045},"id":"CVE-2026-41573-0cb90f5e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241"},{"id":"CVE-2026-41573-132621b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/idm/plugins/internal/SpecialRepo.java","function":"search"},"deprecated":false,"digest":{"function_hash":"295626144876242740997295161202165734807","length":2029}},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-federation/OpenFM/src/main/java/com/sun/identity/plugin/datastore/impl/IdRepoDataStoreProvider.java"},"deprecated":false,"digest":{"line_hashes":["120938139116289285667127241765814848608","309837962224323150481775973747346084368","88443493052584528012905128538603622334","331043811371428108022320710733073617140","315571084820619732641310301884950312417"],"threshold":0.9},"id":"CVE-2026-41573-1d135ced","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["79518034138404092541674349722282318097","71143060825792027195452728431414783520","85637574741820746994379428200358174829","127763455436296965582455145183479163310","324636676058650659813963712966741172818"],"threshold":0.9},"id":"CVE-2026-41573-27292a88","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-datastore/src/main/java/org/forgerock/openam/idrepo/ldap/DJLDAPv3Repo.java"}},{"source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/idm/server/IdServicesImpl.java"},"deprecated":false,"digest":{"line_hashes":["227567297356084730272433159295613121730","99286007297473187865254115309754391283","200460176481896639629220733410914720620","60939393796561987997887565202929179588","57874978942316369375745879018722084455"],"threshold":0.9},"id":"CVE-2026-41573-2a7e082a","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"334579889618120766372718015365275695643","length":1019},"id":"CVE-2026-41573-48e6b903","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/idm/server/IdServicesImpl.java","function":"isSpecialIdentity"},"deprecated":false},{"target":{"file":"openam-datastore/src/test/java/org/forgerock/openam/idrepo/ldap/GenericRepoTest.java","function":"searchReturnsMatchesForComplexFilters"},"deprecated":false,"digest":{"function_hash":"2315827065274183438392040940123194637","length":971},"id":"CVE-2026-41573-52da4e62","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core-rest/src/main/java/org/forgerock/openam/core/rest/IdentityResourceV1.java"},"deprecated":false,"digest":{"line_hashes":["110102859940112613150583882861188360081","122636717404547963879031503660852378777","283278834019438945815940127808636673575","248559743262613432308927580843795040848","225291733717706693886184132950346383529"],"threshold":0.9},"id":"CVE-2026-41573-5d178ccc"},{"deprecated":false,"digest":{"function_hash":"154361791928706909844999953780269783090","length":1461},"id":"CVE-2026-41573-71e771d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/delegation/plugins/DelegationPolicyImpl.java","function":"getSubjects"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-datastore/src/test/java/org/forgerock/openam/idrepo/ldap/GenericRepoTest.java"},"deprecated":false,"digest":{"line_hashes":["21058435141308934127605456863763004380","5148539613764385180258995461288601247","278568282120199285299915228683535617810","193494516123885642424284294501559855341","252639731806417273431986803473962342325","64488896854318593815659507731307896948","283321805332382599584469075883769089778","258999775686778242153660419334515276731","112331946680750868071407832193106045152","316017222494961091257724528004480964596","206736192112436006755611438423137615900","333683418888783190157875835671734869130","133476799123490524416609064117283798362","37396857882983729523926897503633055231","36770971297073471423999995330204067910"],"threshold":0.9},"id":"CVE-2026-41573-7728752a"},{"digest":{"function_hash":"148799305465917214734126230189964056350","length":758},"id":"CVE-2026-41573-96cef043","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"function":"getFilter","file":"openam-datastore/src/main/java/org/forgerock/openam/idrepo/ldap/DJLDAPv3Repo.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["202610882099468651022473242880277343985","325762385168118851845922457149957558699","39265090109029391898661952881058238013","214779069638408790746661839695321112085","219857168752283240619180399746518846907","224947995667076098299129310608015192420","157150346795879618624611361893190751464","105122221404311208303928336086419777666","119683497195130248434132661450663757060"],"threshold":0.9},"id":"CVE-2026-41573-a7c61222","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/idm/plugins/internal/SpecialRepo.java"}},{"deprecated":false,"digest":{"line_hashes":["88338106488651555537095770763355424606","319840735003126735021294709550554828932","126054615488234182590247720445900166159","161434957437703938634895612516066056460","316248058253523738007171972408292980006"],"threshold":0.9},"id":"CVE-2026-41573-d6290af1","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core/src/main/java/com/sun/identity/delegation/plugins/DelegationPolicyImpl.java"}},{"deprecated":false,"digest":{"function_hash":"309013077002518291601984546840423986904","length":507},"id":"CVE-2026-41573-e484fc22","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-datastore/src/test/java/org/forgerock/openam/idrepo/ldap/GenericRepoTest.java","function":"searchReturnsMatchesForSearchAttribute"}},{"target":{"file":"openam-federation/OpenFM/src/main/java/com/sun/identity/plugin/datastore/impl/IdRepoDataStoreProvider.java","function":"getUserID"},"deprecated":false,"digest":{"function_hash":"163103841492916242848324980475612645116","length":1403},"id":"CVE-2026-41573-eff8d2f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241"},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241","target":{"file":"openam-core-rest/src/main/java/org/forgerock/openam/core/rest/IdentityResourceV1.java","function":"queryCollection"},"deprecated":false,"digest":{"function_hash":"136021682261699233002855244872054726446","length":796},"id":"CVE-2026-41573-f36f36ee","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41573.json","vanir_signatures_modified":"2026-09-17T08:04:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}