TI-2026-74437 Aliases CVE-2026-55167

Replay of WebAuthn authentication challenge in LDAP Account Manager

LOW 19CWE-294Published 2026-10-14 · Updated 2026-10-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

LDAP Account Manager (lam) before 9.6 is affected when WebAuthn two factor authentication is enabled. The WebAuthn authentication challenge stays in the PHP session after the authentication response is processed, so the signed ceremony state can be replayed (CWE-294). A user who has already completed valid password authentication can keep reusing that state instead of consuming it once. Exploitation requires a valid password, the same PHP session and a valid authenticator signature.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00206 10th percentileScored 2026-11-07

Fix Fixed lam (LDAPAccountManager): 9.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LDAPAccountManager	lam	before 9.6	9.6	Patch available	CNA

lam VendorLDAPAccountManager Affected before 9.6 Fixed in 9.6 Patch available CNA

Remediation

Upgrade LDAP Account Manager (lam) to version 9.6, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA lam (LDAPAccountManager) Fixed in 9.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-15 Threatist record created from CVE-2026-55167
2026-10-20 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Other 3

TI-2022-13128 Unauthenticated Remote Code Execution in ldap-account-manager CVSS 3.1HIGH 8.1
TI-2022-08663 Stored XSS and path traversal in LDAPAccountManager/lam CVSS 3.1HIGH 8.1
TI-2024-35306 Arbitrary config values override in lam CVSS 3.1MEDIUM 6.5
TI-2024-15435 LAM vulnerable to Authenticated Remote Code Execution CVSS 3.1HIGH 7.9
TI-2022-13130 Incorrect Regular Expressions in ldap-account-manager CVSS 3.1HIGH 8.8
TI-2018-06319 Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in… CVSS 3.0HIGH 8.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences