CVE-2021-29156: ForgeRock OpenAM LDAP injection via Webfinger

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-accessible LDAP injection with high confidentiality impact and very high EPSS, though not in KEV.

What it is

ForgeRock OpenAM before 13.5.1 is vulnerable to LDAP injection through the Webfinger protocol. An unauthenticated attacker can inject LDAP filter content to extract sensitive data such as password hashes, session tokens, or private keys. This is a high-severity information disclosure flaw in an identity and access management product.

Impact

An attacker can retrieve password hashes character by character, or obtain session tokens and private keys, enabling credential theft and potential authentication bypass or impersonation. The confidentiality impact is high; there is no integrity or availability impact per the CVSS vector.

Attack surface

The flaw is reachable over the network via the Webfinger protocol endpoint, with no authentication or user interaction required (CVSS vector AV:N/AC:L/PR:N/UI:N). Any exposed OpenAM instance running a vulnerable version is a candidate.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.76385, 99.5th percentile) and references are tagged Exploit, indicating public exploit information exists. No ransomware usage is documented.

What to do

• Upgrade ForgeRock OpenAM to version 13.5.1 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the Webfinger endpoint to trusted sources only.
• Review and harden LDAP query construction to use parameterized or escaped inputs, and validate all Webfinger input.
• Rotate any credentials, session tokens, or private keys that may have been exposed on vulnerable instances.
• Monitor vendor advisories and apply any additional patches or workarounds ForgeRock publishes.

Detection

• Inspect Webfinger request logs for LDAP filter metacharacters such as parentheses, asterisks, and boolean operators in user-supplied parameters.
• Alert on anomalous or repeated Webfinger requests that resemble character-by-character extraction patterns.
• Monitor LDAP server logs for unusual queries or high volumes of filter-based lookups originating from OpenAM.
• Audit access to sensitive attributes (password hashes, session tokens, private keys) and alert on unexpected reads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.