Which versions of LDAP are affected by EUVD-2026-78360?

OpenAM Community Edition through version 16.0.6 contains a critical pre-authentication login bypass vulnerability that permits unauthenticated attackers to create valid sessions for any user without…. A patch is available.

How to fix or mitigate EUVD-2026-78360?

Within 24 hours: Identify all OpenAM Community Edition instances and determine if MSISDN authentication module is active in any realm. Within 7 days: Begin testing upgrade to OpenAM 16.1.1 in non-production environment to validate application compatibility. Within 30 days: Deploy OpenAM 16.1.1 to all affected production systems.

LDAP EUVD-2026-78360

Q: What is the CVSS score of EUVD-2026-78360?

EUVD-2026-78360 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

| CVE-2026-46619 CRITICAL

LDAP Injection (CWE-90)

2026-06-26 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-xq73-fvmr-jvmm

Authentication Bypass LDAP Code Injection

9.3

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Advisory states unauthenticated remote password-less bypass (AV:N/PR:N/UI:N), default allow-all gateway keeps it low-complexity (AC:L), yielding full account impersonation (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

Jun 26, 2026 - 18:15 vuln.today

Analysis Generated

Jun 26, 2026 - 18:15 vuln.today

DescriptionCVE.org

Summary

Description

An LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacker to obtain an arbitrary OpenAM session without a password in the default trusted gateway configuration. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

Impact

OpenAM deployments through version 16.0.6 that have MSISDN enabled are potentially affected. This enables a pre-authentication login bypass for any realm where an MSISDN module instance is enabled in an authentication chain and reachable through the trusted-gateway list, which allows all traffic by default. The request-supplied MSISDN value was concatenated directly into an LDAP search filter. The resulting OpenAM session is a normal authenticated session for the matched user.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

We need answer JSON only. Need synthesize. Need careful with fields. Let's inspect input.

CVE-2026-46619. Description LDAP Injection CWE-90 in MSISDN auth module, unauthenticated remote attacker obtain arbitrary OpenAM session without password in default trusted gateway configuration. Affects OpenAM Community Edition through 16.0.6, patched 16.1.1.

CVSS provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. It says CVSS Score 9.3. Need assess own vector in 3.1 and 4.0. Base only maybe.

Multi-source: Patch available, reported by github. CPE pkg:maven/... openam-auth-msisdn. Tags: Authentication Bypass, LDAP, Code Injection. References commit, release, GHSA.

We need fields.

product_name: "OpenAM" or "OpenAM Community Edition"? 1-3 words. Specific product name "OpenAM" or "OpenAM Community Edition". The package is OpenAM. Use "OpenAM Community Edition" maybe 3 words. Fine.

summary: Original synthesis, not copy description. Need mention LDAP injection in MSISDN module allows unauthenticated remote login bypass/no password, default trusted gateway (allows all traffic by default), through 16.0.6 patched 16.1.1. No KEV, no POC provided? Exploitation status: no public exploit identified at time of analysis. EPSS not provided. Should mention POC? Multi-source has no POC. Public exploit no. Summary should mention no KEV? It says "if actively exploited (KEV), if POC exists, and EPSS risk if notable." None so no mention maybe. But can state no public exploit identified. Start with impact verb+product: "Authentication bypass in OpenAM Community Edition through 16.0.6 allows..." Need avoid "A vulnerability". Good.

technical_context: Underlying LDAP search filter concatenation, MSISDN authentication module (mobile subscriber number). CWE-90 LDAP injection. CPE exact affected products: maven org.openidentityplatform.openam:openam-auth-msisdn <16.