CVE-2021-29156
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an...
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
- Record
CVE-2021-29156- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
- Record
CVE-2021-29156- Updated
- 2026-11-02
EUVDEUVD-2021-15795 No score
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
- Record
EUVD-2021-15795- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8984-9gww-h52x No score
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an...
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
- Record
GHSA-8984-9gww-h52x- Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenAM 13.0 - LDAP Injection | 2021-11-03 |
| Nuclei | LDAP Injection In OpenAM | |
| PoC in GitHub | 5amu/CVE-2021-29156 | 2022-10-07 |
| PoC in GitHub | guidepointsecurity/CVE-2021-29156 | 2021-11-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29156 is a high vulnerability (CVSS 7.5) in Forgerock Openam, published March 25, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 76.8%, the 99th percentile. No source names a fixed version.