CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
Attackers with valid credentials and session access can reuse WebAuthn challenges, bypassing two-factor authentication requirements in LDAP Account Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55167?
CVE-2026-55167 is a medium-severity vulnerability in LDAPAccountManager lam, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
Weakness: CWE-294
Which versions are affected by CVE-2026-55167?
How do I fix CVE-2026-55167?
Upgrade to a fixed version.
Is CVE-2026-55167 being exploited?
There is no known exploitation of CVE-2026-55167 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-55167, GHSA-xgjg-fchx-x3g3, UBUNTU-CVE-2026-55167.