CVE-2026-41573: OpenAM Authentication Bypass Vulnerability

CVE-2026-41573 Overview

CVE-2026-41573 is an LDAP injection vulnerability in Open Identity Platform's Open Access Management (OpenAM), an open-source access management solution. The flaw exists in the IdentityResourceV1.queryCollection() method, which passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled. This bypasses a prior protection introduced for CVE-2021-29156. The unescaped value flows into DJLDAPv3Repo.getFilter(), where it is concatenated directly into an LDAP filter string. Authenticated attackers can inject LDAP metacharacters to enumerate users and perform blind LDAP injection [CWE-90].

Critical Impact

Authenticated attackers can inject LDAP metacharacters through the _queryId parameter to enumerate directory users and exfiltrate identity attributes via blind LDAP injection.

Affected Products

• Open Identity Platform OpenAM versions prior to 16.1.1
• OpenAM openam-core-rest component (IdentityResourceV1)
• OpenAM openam-core LDAP repository component (DJLDAPv3Repo)

Discovery Timeline

• 2026-09-15 - CVE-2026-41573 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-41573

Vulnerability Analysis

The vulnerability resides in the REST identity resource layer of OpenAM. When a client issues a query against /json/{realm}/users, the IdentityResourceV1.queryCollection() method constructs a CrestQuery object using the client-supplied _queryId parameter. The escapeQueryId flag on this call is set to false, disabling the sanitization that was added to remediate CVE-2021-29156.

The raw _queryId value propagates downstream into DJLDAPv3Repo.getFilter(), which concatenates the string into an LDAP search filter without escaping. Because LDAP filter syntax treats characters such as *, (, ), \, and NUL as control characters, an authenticated attacker can craft _queryId values that alter the resulting filter logic. The attacker can then enumerate accounts, test attribute values, and extract sensitive directory data one bit at a time using boolean-based blind injection techniques.

Root Cause

The root cause is the removal or omission of query identifier escaping in the code path from IdentityResourceV1 to the LDAP repository layer. The escapeQueryId=false argument disables input neutralization for a value that ultimately reaches an LDAP filter interpreter, matching the definition of Improper Neutralization of Special Elements Used in an LDAP Query [CWE-90].

Attack Vector

Exploitation requires an authenticated session with permission to invoke the users query endpoint. The attacker issues HTTP requests to /json/{realm}/users with a malicious _queryId parameter containing LDAP metacharacters. Response differences (result presence, timing, or error state) reveal directory contents through blind injection.

// Patch reference: openam-core-rest/src/main/java/org/forgerock/openam/core/rest/IdentityResourceV1.java
// Copyright header update reflecting the security fix for CVE-2026-41573
 * Copyright 2012-2016 ForgeRock AS.
- * Portions copyright 2022-2025 3A Systems, LLC.
+ * Portions copyright 2022-2026 3A Systems, LLC.

// Companion patch: openam-core/src/main/java/com/sun/identity/delegation/plugins/DelegationPolicyImpl.java
 * Portions Copyrighted 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2022-2026 3A Systems LLC.

Source: OpenAM security commit d3d86c9

Detection Methods for CVE-2026-41573

Indicators of Compromise

• HTTP requests to /json/{realm}/users containing LDAP metacharacters (*, (, ), \, \00) within the _queryId parameter.
• Anomalous spikes in authenticated queries against the OpenAM users REST endpoint from a single principal or IP.
• LDAP server logs showing malformed or unusually complex search filters originating from the OpenAM service account.

Detection Strategies

• Inspect OpenAM access logs for _queryId values that deviate from application-defined query identifiers such as those registered in the realm configuration.
• Correlate REST API activity with backend LDAP filter strings to identify user-controlled substrings reaching the directory.
• Deploy WAF or reverse proxy rules that flag or block requests where _queryId contains characters outside [A-Za-z0-9_-].

Monitoring Recommendations

• Enable verbose LDAP query auditing on the backend directory bound to OpenAM to capture filter payloads.
• Alert on authenticated OpenAM sessions issuing high volumes of queryCollection calls with varying _queryId values, consistent with blind injection probing.
• Monitor for enumeration patterns such as sequential character-by-character discovery in filter strings.

How to Mitigate CVE-2026-41573

Immediate Actions Required

• Upgrade OpenAM to version 16.1.1 or later, which contains the fix for CVE-2026-41573.
• Audit existing OpenAM user accounts and revoke unnecessary privileges to the /json/{realm}/users query endpoint.
• Review LDAP and OpenAM logs for prior exploitation attempts using anomalous _queryId values.

Patch Information

The vendor released a fix in OpenAM Release 16.1.1. Technical details of the code change are documented in the GitHub Security Advisory GHSA-2vg8-q4c2-5cw3 and the remediation commit.

Workarounds

• Restrict access to the /json/{realm}/users endpoint using network controls or reverse proxy ACLs until patching is complete.
• Apply a WAF rule that rejects requests where the _queryId parameter contains LDAP metacharacters.
• Reduce the privileges of the OpenAM LDAP bind account to limit the scope of any successful enumeration.

# Example WAF/nginx snippet: block LDAP metacharacters in the _queryId parameter
if ($args ~* "(^|&)_queryId=[^&]*[\*\(\)\\]") {
    return 403;
}