---
id: CVE-2026-41573
title: Open Access Management (OpenAM) is an access management solution
summary: >-
  Open Access Management (OpenAM) is an access management solution. Prior to
  16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter
  from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing
  protectio…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-90
  - CWE-74
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.1
patched:
  - 'org.openidentityplatform.openam:openam-core-rest 16.1.1'
published: '2026-09-15'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:21:42.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41573'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/commit/d3d86c951a4c3c353719b761ea0b4be80f9dd241
    label: security-advisories@github.com
  - url: 'https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2vg8-q4c2-5cw3
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8984-9gww-h52x'
  - url: 'https://github.com/advisories/GHSA-2vg8-q4c2-5cw3'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
epss: 0.00496
epssPercentile: 0.39999
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T12:41:12.866342Z'
cvssSource: cna
ingestedAt: '2026-06-29T13:24:35.518Z'
---

## Overview

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-41573)

Affected packages:

- `org.openidentityplatform.openam:openam-core-rest <= 16.0.6`

Patched in:

- `org.openidentityplatform.openam:openam-core-rest 16.1.1`

Source: https://github.com/advisories/GHSA-2vg8-q4c2-5cw3