PEAKUP Technology Inc. PassGate implements filters and entries in LDAP queries that are not properly neutralized, resulting in an LDAP injection flaw. The flaw allows attacker‑supplied input to alter the syntax of an LDAP request (CWE‑90). Consequently, an attacker could possibly retrieve or modify directory information, thereby impacting confidentiality and integrity of the stored data. The vulnerability’s effect is limited to the directory data accessed in the context of the PassGate service.

All releases of PEAKUP PassGate up through build 30042026 are affected, as listed by the vendor. Versions newer than that build have already incorporated the fix that prevents LDAP query manipulation.

The CVSS score of 8.2 classifies this as high severity. The EPSS score indicates a less than 1% probability of exploitation, and the vulnerability is not included in the CISA KEV catalog, so no widespread exploitation has been observed. It is inferred that attackers would need network access to the PassGate service to supply crafted input; if successful, the flaw would allow tampering with LDAP queries that retrieve or alter directory entries.