CVE-2026-92288

Lemonldap::NG::Portal fails to authenticate callers of its OAuth2 token introspection endpoint when the request names a Relying Party marked as public. The checkEndPointAuthenticationCredentials() routine skips the client secret comparison for public RPs yet still reports an authentication method (client_secret_basic or client_secret_post), so introspection() accepts any request carrying a public client_id with an arbitrary or empty secret. An attacker who holds any access token and knows a public client_id can confirm the token is active and read its metadata, including scope, audience, expiry, and the sub claim. Because sub is computed with the calling RP's user identifier attribute, an attacker can translate user identifiers between Relying Parties, defeating per-client and pseudonymous identifiers. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Upgrade to Lemonldap::NG 2.21.6 (2.20.x/2.21.x branch) or 2.23.4 (2.22.x/2.23.x branch) or later, where the public-RP secret check is enforced. Until patched, restrict network access to the introspection endpoint and review which Relying Parties are configured as public; audit logs for introspection requests presenting public client_ids with empty or invalid secrets. If cross-RP identifier correlation is a concern, assess which user attribute each RP uses for sub and rotate any access tokens issued during the exposure window.