The exception is caused by an error in the code. A [TreeSet][1] java object is modified while a for loop iterates on it and this generates the ConcurrentModificationException as described by the javadoc.

For details please see the issue I created on JIRA-GeoServer ticket tracker.
[https://osgeo-org.atlassian.net/browse/GEOS-9488][2]

I solved, at least in test environment, by modifying the code and by recompiling the classes affected by the error. Thus I generated a new gs-sec-ldap-2.16-SNAPSHOT.jar file and replaced the gs-sec-ldap-1.16.1.jar file in the lib folder of the geoserver.

More in detail I modified the `LDAPRoleService.getRolesForUser` and the `LDAPUserGroupService.getGroupsForUser` methods, as also described in the JIRA ticket, as follows:

       public SortedSet<GeoServerRole> getRolesForUser(final String username) throws IOException 
            final SortedSet<GeoServerRole> roles = new TreeSet<GeoServerRole>();
            // new set containing only nested parent roles
            final SortedSet<GeoServerRole> parentRoles = new TreeSet<GeoServerRole>();
            //...
            if (useNestedGroups) {
                for (GeoServerRole erole : roles) { 
                    searchNestedParentRoles(erole, parentRoles, 1);   
                }
                roles.addAll(parentRoles);
    
            }
            return Collections.unmodifiableSortedSet(roles);
        }


  [1]: https://docs.oracle.com/javase/8/docs/api/java/util/TreeSet.html
  [2]: https://osgeo-org.atlassian.net/browse/GEOS-9488