LDAP Account Manager (LAM) holds the WebAuthn challenge in a PHP session after the authentication response is processed. This allows an attacker who already has a valid password and session to replay a signed WebAuthn ceremony state instead of consuming it once. The flaw is an instance of improper session handling (CWE-294) and is mitigated only by the requirement of a valid password, signed authenticator, and the same session.

The vulnerability affects installations of LDAPAccountManager (LAM) older than version 9.6 when WebAuthn two‑factor authentication is enabled. Users running these versions in any web hosting environment that supports LAM are subject to the flaw, regardless of other configuration settings or network topology.

The CVSS score of 4.2 reflects a medium severity for functions exposed to authenticated users. The EPSS score of less than 1% indicates a very low likelihood that this weakness will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. To exploit the flaw an attacker would need to interact with the web application, retain the targeted user’s PHP session, possess a correct password, and provide a valid authenticator signature. The in‑session requirement reduces the practical risk but does not eliminate it.