OpenAM, an open-source identity and access management platform, has an LDAP injection vulnerability in its REST API. The flaw exists in the `_queryId` HTTP query parameter used in user and group query endpoints, where input is not properly escaped before being incorporated into LDAP filter strings. This allows authenticated attackers to inject LDAP metacharacters, potentially enabling user enumeration and blind LDAP injection attacks. The vulnerability affects OpenAM versions prior to 16.1.1 and has a high severity rating with a CVSS score of 8.7. A fix is available in version 16.1.1.