CVE-2021-29156: ForgeRock Openam

High severity, CVSS 7.5. EPSS: 76.8% chance of exploitation in the next 30 days.

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

Affected products

• ForgeRock Openam: before 13.5.1 (fixed in 13.5.1)

Published 2021-03-25. Last modified 2026-06-17.