High severity7.5NVD Advisory· Published Mar 25, 2021· Updated Jun 17, 2026

CVE-2021-29156

Description

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Forgerock/Openam2 versions
cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*range: <13.5.1
- (no CPE)range: <13.5.1
ForgeRock/OpenAMdescription

Patches

Vulnerability mechanics

References

bugster.forgerock.org/jira/browse/OPENAM-10135nvdExploitPatchVendor Advisory
portswigger.net/research/hidden-oauth-attack-vectorsnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.061
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000