CVE-2026-46619: OpenAM LDAP Injection Auth Bypass Vulnerability

CVE-2026-46619 Overview

Open Identity Platform OpenAM contains an LDAP injection vulnerability in the Mobile Station International Subscriber Directory Number (MSISDN) authentication module. The MSISDNValidation component concatenates the request-supplied MSISDN value directly into an LDAP search filter without escaping metacharacters. The default empty trusted-gateway list permits all inbound traffic to reach the vulnerable code path. An unauthenticated remote attacker can inject LDAP filter syntax, match an arbitrary user, and obtain a valid authenticated OpenAM session without knowing a password. The flaw is tracked as [CWE-90] and is fixed in version 16.1.1.

Critical Impact
Unauthenticated attackers can bypass authentication and hijack arbitrary user sessions in any OpenAM realm where an MSISDN module is present in a reachable authentication chain.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM deployments with the MSISDN authentication module enabled in any reachable authentication chain
Realms using default trusted-gateway configuration (empty list)

Discovery Timeline

2026-09-15 - CVE-2026-46619 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-46619

Vulnerability Analysis

The vulnerability resides in the MSISDN authentication module shipped with OpenAM. This module identifies subscribers by their mobile phone number and is designed for scenarios where a trusted gateway forwards the MSISDN header. During authentication, the MSISDNValidation routine constructs an LDAP search filter by concatenating the attacker-controlled MSISDN parameter into the filter string.

The module also enforces a trusted-gateway allow-list. When the list is empty, the module treats all clients as trusted and processes their MSISDN input. This is the default state, which removes the network-layer restriction that would otherwise constrain access.

By combining both weaknesses, an attacker crafts an LDAP filter fragment that matches any account. The module selects the first matching directory entry, considers authentication successful, and issues a full OpenAM session token. The attacker gains the privileges of the selected user without a credential exchange.

Root Cause

The root cause is [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query. User-supplied MSISDN values are inserted into the LDAP search filter without escaping characters such as (, ), *, \, and \0. A secondary design flaw permits authentication requests from any source when the trusted-gateway list is empty, which is the default installation state.

Attack Vector

Exploitation requires only network reachability to an OpenAM realm exposing an authentication chain that includes the MSISDN module. The attacker submits a crafted HTTP request containing an LDAP wildcard or filter expression in place of a legitimate MSISDN value. The injected filter matches at least one user entry, and OpenAM returns an authenticated session cookie for that user.

java

// Patched file: openam-authentication/openam-auth-msisdn/src/main/java/
//   com/sun/identity/authentication/modules/msisdn/MSISDN.java
// The 16.1.1 release introduces proper escaping of the MSISDN input
// before it is placed into the LDAP search filter, and hardens the
// trusted-gateway evaluation so an empty allow-list no longer accepts
// arbitrary sources.
//
// Source: https://github.com/OpenIdentityPlatform/OpenAM/commit/9814d51f578341e012e4def9dc936e00dd1ce913

Detection Methods for CVE-2026-46619

Indicators of Compromise

HTTP authentication requests to OpenAM MSISDN endpoints containing LDAP metacharacters such as *, (, ), |, or & in the MSISDN parameter or header
Successful session issuance events immediately following anomalous MSISDN input
Session tokens issued for privileged accounts from source IPs that do not match known mobile gateways
Unusual sequences of failed MSISDN lookups followed by a successful login

Detection Strategies

Inspect access logs for OpenAM authentication endpoints that reference the MSISDN module, and alert on non-numeric characters in the MSISDN field
Correlate LDAP directory query logs with OpenAM session issuance to identify searches containing wildcard filters
Baseline the source IP ranges of legitimate MSISDN gateway traffic and flag deviations

Monitoring Recommendations

Enable verbose authentication auditing on all OpenAM realms that expose MSISDN chains
Forward OpenAM audit and container logs to a centralized platform for retention and query
Monitor for creation of authenticated sessions that lack a preceding credential validation event

How to Mitigate CVE-2026-46619

Immediate Actions Required

Upgrade OpenAM to version 16.1.1, which contains the fix committed in 9814d51f578341e012e4def9dc936e00dd1ce913
Audit every realm and authentication chain for the presence of the MSISDN module and disable it where not required
Populate the MSISDN trusted-gateway list with the explicit IP addresses of legitimate mobile gateways
Rotate active OpenAM session tokens and force re-authentication for privileged accounts

Patch Information

The fix is included in OpenAM Release 16.1.1. Technical details are documented in the GitHub Security Advisory GHSA-xq73-fvmr-jvmm and the corresponding GitHub commit change. Administrators should apply the upgrade before implementing configuration workarounds.

Workarounds

Remove the MSISDN authentication module from every reachable authentication chain until the upgrade is applied
Configure a non-empty trusted-gateway allow-list restricted to the IP addresses of authorized mobile network gateways
Place a reverse proxy or web application firewall in front of OpenAM to strip or validate MSISDN parameters and reject values containing LDAP metacharacters
Restrict network access to OpenAM authentication endpoints from untrusted networks

bash

# Example WAF rule concept: reject MSISDN authentication requests
# that contain LDAP metacharacters in the MSISDN parameter.
# Adapt syntax to your specific WAF or reverse proxy.
SecRule ARGS:MSISDN "@rx [\(\)\*\|\&\\\\]" \
    "id:1046619,phase:2,deny,status:400,\
    msg:'CVE-2026-46619 OpenAM MSISDN LDAP injection attempt'"