CVE-2026-41573 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM instances, especially those handling user authentication, should assess exposure and apply patches. They should also review authentication and authorization configurations, monitor for suspicious LDAP activity, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-41573 is a high-severity vulnerability in OpenAM that allows authenticated attackers to inject LDAP metacharacters, enabling user enumeration and blind LDAP injection. Defenders should prioritize verifying exposure and applying patches for OpenAM instances, especially those handling user authentication.

• User enumeration and authentication bypass
• Blind LDAP injection for data extraction
• Potential for lateral movement within the network
• Requires verification of OpenAM version and patching

Technical summary

CVE-2026-41573 is a vulnerability in Open Access Management (OpenAM) prior to version 16.1.1. The issue allows an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection due to improper escaping of the _queryId parameter. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The issue is fixed in version 16.1.1. Defenders should assess exposure and apply patches, especially for OpenAM instances handling user authentication. The vulnerability can be exploited for user enumeration and blind LDAP injection.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for OpenAM instances, especially those handling user authentication.

Recommended defensive actions

• Verify OpenAM version and apply patch 16.1.1 if vulnerable
• Review authentication and authorization configurations
• Monitor for suspicious LDAP activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity. The issue is fixed in OpenAM version 16.1.1. The vulnerability allows an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection due to improper escaping of the _queryId parameter. There are no known exploits or reports of the vulnerability being used in attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.