CVE-2026-41573

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.

• CWE-90

• https://github.com/OpenIdentityPlatform/OpenAM/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2vg8-q4c2-5cw3

Published

Sep 15, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41568Moby is an open source container framework. In Docker Engine…6.1
• CVE-2026-41569authentik is an open-source identity provider. Prior to vers…6.1
• CVE-2026-4157ChargePoint Home Flex revssh Service Command Injection Remot…7.5
• CVE-2026-41570PHPUnit is a testing framework for PHP. In versions 12.5.21 …7.8
• CVE-2026-41571Note Mark is an open-source note-taking application. In vers…9.4
• CVE-2026-41572Note Mark is an open-source note-taking application. Prior t…5.3
• CVE-2026-41574Nhost is an open source Firebase alternative with GraphQL. P…9.8
• CVE-2026-41575In th30d4y/IP from version 1.0.1 to before version 2.0.1, a …6.1
• CVE-2026-41576Brave CMS is an open-source CMS. Prior to commit 6c56603, th…7.1
• CVE-2026-41577authentik is an open-source identity provider. Prior to vers…7.5
• CVE-2026-41579runc is a CLI tool for spawning and running containers accor…3.3
• CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Ele…7.3