Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the     MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter     without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an     MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can     inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated     OpenAM session without a password. This issue is fixed in version 16.1.1. (CVE-2026-46619)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the
    MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter
    without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an
    MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can
    inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated
    OpenAM session without a password. This issue is fixed in version 16.1.1. (CVE-2026-46619)

ID	Name	Product	Family	Type	Severity
346363	Linux Distros Unpatched Vulnerability : CVE-2026-46619	Nessus	Misc.	Local	critical
444005	SCA: security update for org.openidentityplatform.openam:openam-auth-msisdn (GHSA-xq73-fvmr-jvmm)	Tenable Cloud Security	SCA Checks	Local	critical
444005	SCA: security update for org.openidentityplatform.openam:openam-auth-msisdn (GHSA-xq73-fvmr-jvmm)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-46619

critical

Tenable Plugins

critical

critical

critical