Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M
CVE-2026-55167LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
Medium 4.2
In plain English
A medium-severity security flaw in lam from LDAPAccountManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ldap-account-manager | no fix listed | DEBIAN-CVE-2026-55167 |
| Debian:13 | ldap-account-manager | no fix listed | DEBIAN-CVE-2026-55167 |
| Debian:14 | ldap-account-manager | 9.6-1 | DEBIAN-CVE-2026-55167 |
| Ubuntu:22.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-55167 |
| Ubuntu:24.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-55167 |
| Ubuntu:26.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2026-55167 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LDAPAccountManager | lam | < 9.6 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N