How to fix or mitigate CVE-2026-41573?

Within 24 hours: Inventory all OpenAM deployments to identify instances running version 16.0.6 or earlier; restrict REST API access to essential services only. Within 7 days: Upgrade all affected OpenAM instances to version 16.1.1 or later. Within 30 days: Review authentication logs for anomalous REST API activity and verify patch deployment across all systems.

CVE-2026-41573

Q: What is the CVSS score of CVE-2026-41573?

CVE-2026-41573 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-78366 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-2vg8-q4c2-5cw3

Denial Of Service

7.1

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable CREST endpoint (AV:N) requires any valid SSO token (PR:L) with no user interaction; primary impact is directory disclosure (C:H), with limited integrity via filter manipulation and no DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

7.1 (HIGH)

Source Code Evidence Fetched

Jun 22, 2026 - 20:16 vuln.today

Analysis Generated

Jun 22, 2026 - 20:16 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.openidentityplatform.openam:openam-core-rest (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 16.1.1.

DescriptionCVE.org

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under /json/{realm}/users. In IdentityResourceV1.queryCollection(), the HTTP query parameter _queryId is passed to a CrestQuery object with escapeQueryId explicitly set to false, bypassing the escape protection introduced as part of the CVE-2021-29156 fix. The unescaped value flows directly to DJLDAPv3Repo.getFilter() where it is concatenated into an LDAP filter string without sanitization, enabling authenticated attackers to inject arbitrary LDAP metacharacters for user enumeration and blind LDAP injection.

Affected Endpoint

Endpoint	Auth Required	Injection Parameter
`GET /openam/json/{realm}/users?_queryId=<INJECTION>`	SSO Token	`_queryId`
`GET /openam/json/{realm}/groups?_queryId=<INJECTION>`	SSO Token (TBD)	`_queryId`

Background: CVE-2021-29156

CVE-2021-29156 was a pre-authentication LDAP injection in OpenAM's Webfinger endpoint, where user-supplied input reached DJLDAPv3Repo.getFilter() unescaped. The fix introduced the escapeQueryId flag in CrestQuery (defaulting to true) and added Filter.escapeAssertionValue() in the filter-building path:

Credit

Discovered by JD-Security SHENYI Team

AnalysisAI

LDAP injection in the Open Identity Platform OpenAM CREST REST API (openam-core-rest, versions up to and including 16.0.6) lets any user holding a valid SSO token inject LDAP filter metacharacters through the _queryId parameter on GET /openam/json/{realm}/users, because IdentityResourceV1.queryCollection() constructs a CrestQuery with the escapeQueryId flag explicitly disabled. The unsanitized value is concatenated into an LDAP search filter in DJLDAPv3Repo.getFilter(), enabling directory user enumeration and blind LDAP data extraction beyond the caller's authorization scope. Exploitation requires authentication (CVSS PR:L) and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and a vendor fix shipping in OpenAM 16.1.1 is available.