CVE-2026-55167 Details
Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
A vulnerability exists in LDAP Account Manager (LAM) versions prior to 9.6, specifically in installations using WebAuthn two-factor authentication. The issue arises because the authentication challenge is not cleared from the PHP session after the response is processed. As a result, a user who has already completed valid password authentication can reuse the same signed WebAuthn ceremony state, instead of it being consumed after use. Although the practical risk is limited—requiring a valid password, the same PHP session, and a valid authenticator signature—this vulnerability could potentially be exploited to replay WebAuthn authentication responses.
Users can upgrade to LDAP Account Manager version 9.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LDAPAccountManager/lam/commit/a56dcaab3e0f572283f5861404ed58d5ea301bc6 | [email protected] | Source CodeVendor |
| https://github.com/LDAPAccountManager/lam/releases/tag/9.6 | [email protected] | Release NotesVendor |
| https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-xgjg-fchx-x3g3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LDAP Account Manager | < 9.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |