CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.
CVE-2026-92288 affects Lemonldap::NG::Portal for Perl from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4. checkEndPointAuthenticationCredentials does not verify the client secret of a public relying party, so OAuth2 token introspection is available without authentication. Timothy Legge posted the issue to oss-security. The advisory does not report observed exploitation.
- CVE-2026-92288 affects Portal 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4.
- The endpoint authentication check skips the client secret of a public relying party.
- Unauthenticated callers can use OAuth2 token introspection.
- CVEs
- CVE-2026-92288
- Vendors
- LemonLDAP::NG
- Products
- LemonLDAP::NG Portal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92288 | Unauthenticated OAuth2 token introspection in Lemonldap::NG::Portal | 9.1 | — |
From the original article
Posted by Timothy Legge on Sep 24 ======================================================================== https://metacpan. org/dist/Lemonldap-NG-Portal...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.