CVE-2026-55167: CWE-294: Authentication Bypass by Capture-replay in LDAPAccountManager lam
Description
LDAP Account Manager (LAM) versions prior to 9.6 with WebAuthn two-factor authentication have an authentication bypass vulnerability. The issue occurs because the WebAuthn challenge remains in the PHP session after processing the authentication response, allowing reuse of the signed WebAuthn ceremony state. Exploitation requires a valid password, the same PHP session, and a valid authenticator signature. This vulnerability is fixed in version 9.6.
CVSS v3.1
Score 4.2medium
Affected software
LDAPAccountManager
lam
pkg:github/ldapaccountmanager/lamRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55167 is an authentication bypass vulnerability in LDAP Account Manager (LAM) prior to version 9.6. The flaw arises from the WebAuthn two-factor authentication implementation, where the challenge is not consumed after authentication but remains in the PHP session. This allows a user who has already authenticated with a valid password to reuse the signed WebAuthn ceremony state, potentially bypassing intended authentication steps. The risk is limited by the need for a valid password, the same PHP session, and a valid authenticator signature. The issue is addressed in LAM version 9.6.
Potential Impact
An attacker with a valid password and access to the same PHP session can reuse the WebAuthn authentication state to bypass additional authentication steps. The confidentiality and integrity of the authentication process are impacted, but availability is not affected. The overall risk is medium due to the multiple conditions required for exploitation.
Mitigation Recommendations
Upgrade LDAP Account Manager to version 9.6 or later where this vulnerability is fixed. No other mitigation or workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T15:13:28.166Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfceab2cdf04f656a1f715
Added to database: 10/14/2026, 18:49:15 UTC
Last enriched: 10/14/2026, 19:03:12 UTC
Last updated: 10/14/2026, 19:08:28 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.