CVE-2026-55167

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) versions prior to 9.6

Description Installations using WebAuthn two-factor authentication fail to clear the challenge from the PHP session after the authentication response is processed. This allows a user who has already successfully authenticated with a password to reuse the same signed WebAuthn ceremony state. The risk is mitigated by the necessity of a valid password, the use of the same PHP session, and a valid authenticator signature.

Recommendations Update to version 9.6.