High severity · published Sep 15, 2026
CVE-2026-41573
OpenAM LDAP Injection via `_queryId` Parameter
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenAM · OpenIdentityPlatform
< 16.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41573
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41573
github.com
https://github.com/OpenIdentityPlatform/OpenAM/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241
github.com
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
github.com
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2vg8-q4c2-5cw3
More from OpenAM
9.8
CVE-2026-62379
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
9.8
CVE-2026-33439
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
9.8
CVE-2023-37471
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security
9.3
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection
9.3
CVE-2026-45052
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints