{"id":"CVE-2026-46619","summary":"OpenAM Authentication Bypass via MSISDN LDAP Injection","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.","aliases":["GHSA-xq73-fvmr-jvmm"],"modified":"2026-09-17T08:08:34.975980Z","published":"2026-09-15T09:51:25.613Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-90"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46619.json"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46619.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-xq73-fvmr-jvmm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46619"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/9814d51f578341e012e4def9dc936e00dd1ce913"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"9814d51f578341e012e4def9dc936e00dd1ce913"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46619.json","vanir_signatures_modified":"2026-09-17T08:08:34Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"81323886887217697449922118085451703555","length":1210},"id":"CVE-2026-46619-056e02b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/9814d51f578341e012e4def9dc936e00dd1ce913","target":{"file":"openam-authentication/openam-auth-msisdn/src/main/java/com/sun/identity/authentication/modules/msisdn/MSISDNValidation.java","function":"getUserId"}},{"digest":{"line_hashes":["203134588775396561525353790959570195814","308098461318944311904573517835687925805","85578315524840150778981251115109359817","113364942227802360364923080444452571377","313459406050198796221730869278239017170","162109934015361598056932942253372476685","99352107426275503156346939610847011028","154334428965458103744712767030099283203","259197304962929427457917929928740529726","182297810898501708707410268661777283517","188677377172357178440871848568288968263","93265270999047898176435912687018049592","292030605556236533825126136437132892557","308960219723920823268271401903569667542","204630476468687113367766160172321209481","52166151909615106152639104103303747107","224597675737019109653659031641057526657","75451785116468825176062015724595039432","297418608668455825521537514948620265063","119613411495908173236637461806446547839","250332732856879541635991613276018726785","307140648632077773166090857547860651833","295592077121439147788857566960549032406","48321829962594218591790623351273671352","208179734838174743268769052185945093807","321604662828966044594553417954639744269","314693975044844894804283831726305326208","292640120345031420201982322661996500494","175660521482846005225899554288591218210","10282431729089350647072490786119246614","631873523318498088457402020417272200"],"threshold":0.9},"id":"CVE-2026-46619-1482003d","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/9814d51f578341e012e4def9dc936e00dd1ce913","target":{"file":"openam-authentication/openam-auth-msisdn/src/main/java/com/sun/identity/authentication/modules/msisdn/MSISDNValidation.java"},"deprecated":false},{"source":"https://github.com/openidentityplatform/openam/commit/9814d51f578341e012e4def9dc936e00dd1ce913","target":{"file":"openam-authentication/openam-auth-msisdn/src/main/java/com/sun/identity/authentication/modules/msisdn/MSISDN.java","function":"initAuthConfig"},"deprecated":false,"digest":{"function_hash":"45402020457667409559336851680970020219","length":871},"id":"CVE-2026-46619-33763998","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"140023744721393235482528799376567450955","length":145},"id":"CVE-2026-46619-c4cce17e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/9814d51f578341e012e4def9dc936e00dd1ce913","target":{"file":"openam-authentication/openam-auth-msisdn/src/main/java/com/sun/identity/authentication/modules/msisdn/MSISDN.java","function":"isValidGateway"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/9814d51f578341e012e4def9dc936e00dd1ce913","target":{"file":"openam-authentication/openam-auth-msisdn/src/main/java/com/sun/identity/authentication/modules/msisdn/MSISDN.java"},"deprecated":false,"digest":{"line_hashes":["248698704399077279240851250986629558958","61274355125588922037281405255174962587","240811838659647690518667175750228802543","239074491632435385329204907532413783730","106050318454190451296366818244894061243","117712914791620785817929139936387680325","282499704133956012805588429959147956818","22338050889154813676443428086608361172","276274264140787528934056109770314392505","105309922375267277892195910414827258568","58939548011195179171138940922463530707","62173604177306427315530403932295878277","154459410725336353368621676640967394931","103982013595466248902146081276629792853","134905255519976245240906854830175723126","328759487135336975804804858847316916580","30556574037850429988716693429456185831","152046520796545546892190255718419607621","112236326831130270363823736790747632457","10400953066960522120567051582060727806","167673684806506766103841408880184737510","155842577151250489476842726263930795800","61502466036848425589485488101397910341","243257107777027935170234551243095659544","339940336226496471693483676954283482416","219971012505682987131784491907723917762","155042609843095779478769599137322973020","237971481903895985712747468519439114660","251440814660725113304881597495477676032","164266563203001346533276424426612951578","191660254445397476139739038837620301974","201308990953332162191801903771351583800","4324214845991889803627883108628381428","150335396880301196422910008265339532851"],"threshold":0.9},"id":"CVE-2026-46619-fa617815"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}