CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret
CVE-2026-92289 lets LemonLDAP::NG public OAuth clients bypass PKCE because client secrets are not verified.
CVE-2026-92289 affects Lemonldap::NG::Portal for Perl from 2.23.0 before 2.23.4. In "PKCE or secret" mode, checkEndPointAuthenticationCredentials does not verify the client secret of a public relying party, allowing a PKCE bypass. The report was posted to oss-security by Timothy Legge. No exploitation in the wild is described.
- CVE-2026-92289 affects Lemonldap::NG::Portal 2.23.0 before 2.23.4.
- checkEndPointAuthenticationCredentials does not verify the client secret.
- Public relying parties configured for PKCE or secret can bypass PKCE.
- CVEs
- CVE-2026-92289
- Vendors
- LemonLDAP::NG
- Products
- LemonLDAP::NG Portal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92289 | PKCE bypass in Lemonldap::NG Portal 2.23.0–2.23.3 enables token theft | 9.1 | — |
From the original article
Posted by Timothy Legge on Sep 24 ======================================================================== https://metacpan. org/dist/Lemonldap-NG-Portal VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.