LDAP Account Manager CVE-2026-55167

Exploitation requires LAM configured with WebAuthn two-factor authentication enabled (a non-default feature) on a version prior to 9.6. The attacker must have already completed valid password authentication, must operate within the same PHP session, and must present a valid authenticator signature - the signed WebAuthn ceremony state is not invalidated after the first response is processed, so it can be retained rather than consumed once. Limiting factors: a valid password and a genuine authenticator signature are both required, activity is confined to one existing PHP session, and the WebAuthn 2FA feature must be in use, collectively restricting impact to an already-partially-authenticated actor rather than an anonymous remote attacker.

This is a genuinely low-priority issue despite being a 2FA weakness. The CVSS base score of 4.2 (MEDIUM) is consistent with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N: although network-reachable (AV:N), it carries high attack complexity (AC:H) and requires prior low-level privilege (PR:L), meaning the attacker must already hold a valid password and operate within the same authenticated PHP session. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on the CISA KEV list and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis.' All signals align rather than conflict: low CVSS, no KEV, no POC, and a vendor-acknowledged narrow precondition chain (valid password + same session + valid authenticator signature). The CWE-294 (capture-replay) classification and the one-line fix (unset the WebAuthn session challenge) confirm this is a WebAuthn single-use enforcement gap, not a pre-authentication bypass. Net real-world risk is low and should be patched on a routine cycle rather than treated as an emergency.

An attacker who already knows a victim's valid LAM password (or an authenticated insider) completes password authentication and, within the same PHP session, reuses the still-present signed WebAuthn ceremony state instead of it being consumed once, effectively reapplying the second factor rather than re-proving fresh possession of the authenticator. No public exploit code exists, and the high attack complexity plus the need for a captured valid authenticator signature and the same session make opportunistic exploitation impractical.