Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by a broken cryptographic algorithm vulnerability in Bcprov CVE-2025-14813, an LDAP injection vulnerability in Bcprov CVE-2026-0636, a memory allocation with excessive size value vulnerability in Bcprov CVE-2026-12185, an improper validation of...

CVE-2026-46619

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-41573

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-41573

OpenAM prior to 16.1.1 is vulnerable to LDAP injection via the _queryId parameter in CREST REST API user query endpoints (/json/{realm}/users). The root cause is that IdentityResourceV1.queryCollection() passes _queryId to CrestQuery with escapeQueryId explicitly set to false , bypassing the esca...

EUVD-2026-78366

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

EUVD-2026-78360

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46619

OpenAM Community Edition (through 16.0.6) contains an LDAP injection (CWE-90) in the MSISDN authentication module . The request-supplied MSISDN value is concatenated into an LDAP search filter without escaping, and the default empty trusted-gateway list permits all traffic. An unauthenticated rem...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-41573: Improper Neutralization of Special Elements used in an LDAP Query

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-46619: Improper Neutralization of Special Elements used in an LDAP Query

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

Astra Linux – Vulnerability in Bouncycastle

The Bouncy Castle For Java version prior to 1.74 is affected by an LDAP injection vulnerability. This vulnerability only affects applications that use the LDAP CertStore provided by Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the...

LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

GHSA-98Q5-5QH2-7W75 Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 (CVE-2026-0636)

Summary IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 CVE-2026-0636 Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Legion of the Bouncy Castle Inc. BC-JAV...