CVE-2026-46619 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM instances, especially those with MSISDN module enabled, should assess exposure and prioritize upgrading to version 16.1.1. They should verify OpenAM instances for exposure, monitor authentication chains for suspicious activity, and review compensating controls for exposed systems. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-46619 allows unauthenticated remote attackers to inject LDAP filter metacharacters in OpenAM MSISDN authentication module, enabling arbitrary user selection and authenticated session creation without passwords. Defenders should verify exposure, prioritize upgrading to version 16.1.1, and monitor authentication chains.

• Unauthenticated remote attackers can create authenticated sessions
• LDAP filter injection allows for arbitrary user selection
• Normal authenticated OpenAM sessions can be obtained without passwords
• Verification of OpenAM instances and upgrade to 16.1.1 is required

Technical summary

Open Access Management (OpenAM) prior to 16.1.1 has a vulnerability in the MSISDN authentication module where an unauthenticated remote attacker can inject LDAP filter metacharacters, allowing for arbitrary user selection and normal authenticated OpenAM session creation without a password. The vulnerability is fixed in version 16.1.1. Defenders should prioritize verifying exposure of OpenAM instances, especially those with MSISDN module enabled in a reachable authentication chain, and upgrade to version 16.1.1. The fix involves updating to version 16.1.1, which addresses the LDAP filter injection vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of OpenAM instances, especially those with MSISDN module enabled in a reachable authentication chain, and upgrade to version 16.1.1.

Recommended defensive actions

• Verify OpenAM instances for exposure, especially those with MSISDN module enabled
• Upgrade to OpenAM version 16.1.1
• Monitor authentication chains for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. GitHub references provide source-specific details on the fix and advisory. The vulnerability affects OpenAM instances with MSISDN module enabled, and defenders should verify exposure and prioritize upgrading to version 16.1.1. The fix is available in version 16.1.1. Evidence is limited to public sources, and defenders should review official advisories for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.