ZeroDay Findings
Sign inSign up

Findings

CVE-2026-55167

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

Published Oct 14, 2026 · updated Oct 15, 2026

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn c

  2. Oct 15, 2026 · OSV.dev

    Fix available

    ldap-account-manager fixed in 9.6-1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    ldap-account-manager fixed in 9.6-1

  4. Oct 15, 2026 · OSV.dev

    Updated

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn c

Affected

  • Debian:12 ldap-account-manager8.3-1, 8.5-1, 8.6-1
  • Debian:13 ldap-account-manager9.0-1, 9.5.1-1, 9.6-1
  • Debian:14 ldap-account-manager0 → 9.6-1

Sources

  • CVE.orgCVE-2026-55167

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-55167

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is p

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2026-55167
    osv.dev

References

CVE-2026-55167 · ZeroDay Findings