CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 fail to enforce PKCE for public OpenID Connect Relying Parties configured in 'PKCE or secret' mode (oidcRPMetaDataOptionsRequirePKCE = 2). Because checkEndPointAuthenticationCredentials() skips client-secret verification for public clients, an attacker who intercepts an authorization code can replay the client_id with any arbitrary secret at the token endpoint and exchange it for the victim's access, ID, and refresh tokens — exactly the attack PKCE is designed to stop. The authorization endpoint also issues codes without any code_challenge, and validatePKCEChallenge() passes when neither challenge nor verifier is present. Any organization running the 2.23.x branch as an OIDC provider is affected, with higher risk where dynamic client registration is enabled, since it creates every Relying Party in this mode. No CVSS score has been assigned, there is no known public PoC, and no exploitation has been observed in the wild.