CVE-2026-55167
Description
A flaw was found in LDAP Account Manager. This vulnerability allows an authenticated user to bypass multi-factor authentication replay protections by reusing an existing challenge response. Because the application fails to invalidate Web Authentication (WebAuthn) challenges stored in the active session after processing, a user with valid primary credentials can reuse the signed verification state rather than completing a fresh one-time verification.
Statement
This vulnerability is rated with a Moderate impact because exploitation demands strict preconditions, requiring attackers to already have compromised valid primary credentials and maintain an active session. The issue only undermines second-factor replay protection within the existing web session, preventing unauthorized access from completely unauthenticated actors. Furthermore, LDAP Account Manager is third-party software that is not distributed or supported in Red Hat Enterprise Linux.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
