Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.openidentityplatform.openam:openam-auth-msisdn

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7MavenAmendedPublished

    OpenAM Authentication Bypass via MSISDN LDAP Injection

    CVE-2026-46619 · GHSA-xq73-fvmr-jvmm

    Affected
    • Maven org.openidentityplatform.openam:openam-auth-msisdn < 16.1.1
    Fixed in
    16.1.1· Vendor fix available
    Issue
    Description An LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacker to obtain an arbitrary OpenAM session without a password in the default trusted gateway configuration. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1. Impact OpenAM deployments through version 16.0.6 that have MSISDN enabled are potentially affected. This enables a pre-authentication login bypass for any realm where an MSISDN module instance is enabled in an authentication chain and reachable through the trusted-gateway list, which allows all traffic by default. The request-supplied MSISDN value was concatenated directly into an LDAP search filter. The resulting OpenAM session is a normal authenticated session for the matched user. Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

    Recommended action: Upgrade to 16.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →