LDAP Account Manager (LAM)

v9.6 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Secrets & Credentials

✓ No known CVEs patched

This release patches 1 known CVE

Topics

duo group-management lam lam-packaging ldap ldap-management

+4 more

php user-management webauthn yubikey

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release fixes a WebAuthn security vulnerability and adds PHP 8.5 compatibility.

Why it matters: A critical WebAuthn flaw (GHSA-xgjg-fchx-x3g3) is patched; deploy version 9.6 to protect authentication flows.

AI summary

WebAuthn security vulnerability fixed and PHP 8.5 compatibility added.

Type	Severity	Summary	CVE
Security	Critical	WebAuthn security fix applied (GHSA-xgjg-fchx-x3g3) WebAuthn security fix applied (GHSA-xgjg-fchx-x3g3) Source: llm_adapter@2026-06-12 Confidence: high	—
Feature
Feature	Low	PHP 8.5 compatibility added PHP 8.5 compatibility added Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Wildcards for Unix groups and group names supported Wildcards for Unix groups and group names supported Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Usability improvements implemented (issues 684, 687) Usability improvements implemented (issues 684, 687) Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	LAM Pro custom fields now stored in new format on save LAM Pro custom fields now stored in new format on save Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	LDAP suffix from default profile now applied to new objects LDAP suffix from default profile now applied to new objects Source: llm_adapter@2026-06-12 Confidence: high	—

Full changelog

PHP 8.5 compatibility
Wildcards for Unix groups and group of names (674)
Usability improvements (684, 687)
LAM Pro:
- Custom fields: configuration is stored in new format on save of server/self-service profile (old format can still be read) (653)
Fixed bugs:
- LDAP suffix from default profile not applied to new objects (698)
- WebAuthn security fix (GHSA-xgjg-fchx-x3g3)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LDAP Account Manager (LAM)

Get notified when new releases ship.

About LDAP Account Manager (LAM)

Web frontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory.