CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

Lemonldap::NG::Portal fails to authenticate callers of its OAuth2 token introspection endpoint when the request names a Relying Party marked as public. The checkEndPointAuthenticationCredentials() routine skips the client secret comparison for public RPs yet still reports an authentication method (client_secret_basic or client_secret_post), so introspection() accepts any request carrying a public client_id with an arbitrary or empty secret. An attacker who holds any access token and knows a public client_id can confirm the token is active and read its metadata, including scope, audience, expiry, and the sub claim. Because sub is computed with the calling RP's user identifier attribute, an attacker can translate user identifiers between Relying Parties, defeating per-client and pseudonymous identifiers. No public proof of concept is known and there is no evidence of exploitation in the wild.