All vulnerabilities
CVE-2026-41573GHSA-2vg8-q4c2-5cw3

OpenAM has LDAP Injection via `_queryId` Parameter

OpenIdentityPlatform org.openidentityplatform.openam:openam-core-restmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in16.1.1Fixed versionGitHub
Published15 Sep 2026Updated 28 Oct 2026CVE List

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-core-rest, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core-rest</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-core-rest, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core-rest</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under /json/{realm}/users. In IdentityResourceV1.queryCollection(), the HTTP query parameter _queryId is passed to a CrestQuery object with escapeQueryId **explicitly set to false**, bypassing the escape protection introduced as part of the CVE-2021-29156 fix. The unescaped value flows directly to DJLDAPv3Repo.getFilter() where it is concatenated into an LDAP filter string without sanitization, enabling authenticated attackers to inject arbitrary LDAP metacharacters for user enumeration and blind LDAP injection.

Affected Endpoint

| Endpoint | Auth Required | Injection Parameter | |----------|--------------|---------------------| | GET /openam/json/{realm}/users?_queryId=<INJECTION> | SSO Token | _queryId | | GET /openam/json/{realm}/groups?_queryId=<INJECTION> | SSO Token (TBD) | _queryId |

Background: CVE-2021-29156

CVE-2021-29156 was a pre-authentication LDAP injection in OpenAM's Webfinger endpoint, where user-supplied input reached DJLDAPv3Repo.getFilter() unescaped. The fix introduced the escapeQueryId flag in CrestQuery (defaulting to true) and added Filter.escapeAssertionValue() in the filter-building path:

Credit

Discovered by JD-Security SHENYI Team

Text from GitHub Advisory Database

Affected versions 43

  • org.openidentityplatform.openam:openam-core-rest, maven<= 16.0.6GitHub
  • OpenAMaffected: < 16.1.1CVE List
  • org.openidentityplatform.openam:openam-core-rest, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-core-rest, Maven16.1.0OSV

References 6