LemonLDAP::NG

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenSep 25, 2026
Last mentionedSep 25, 2026

Timeline

2 articles · newest first

CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

CVE-2026-92289 lets LemonLDAP::NG public OAuth clients bypass PKCE because client secrets are not verified.

oss-securitySep 25, 00:41 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-922893

CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.

oss-securitySep 25, 00:39 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-922881

Related CVEs

by mentions

CVE-2026-922889.1
Unauthenticated OAuth2 token introspection in Lemonldap::NG::Portal
published Sep 25, 2026Lemonldap::NG::Portal (Perl)
CVE-2026-922899.1
PKCE bypass in Lemonldap::NG Portal 2.23.0–2.23.3 enables token theft
published Sep 25, 2026Lemonldap::NG::Portal (Perl)

Appears with

LemonLDAP::NG Portalproduct · 2

Entities are extracted by the model from each article. First seen Sep 25, 2026, last mentioned Sep 25, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.