LemonLDAP::NG Portal and Handler flaws disclosed
Three oss-security advisories describe LemonLDAP::NG Portal OAuth secret-check failures and a Handler path-rule bypass, with no reported exploitation.
On 2026-09-25, oss-security carried three advisories for Perl components of LemonLDAP::NG. CVE-2026-92288 and CVE-2026-92289, posted by Timothy Legge, share a failure in checkEndPointAuthenticationCredentials to verify the client secret of a public Relying Party: the first allows unauthenticated OAuth2 token introspection in Portal versions from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4, and the second is a PKCE bypass for public Relying Parties in "PKCE or secret" mode in Portal versions from 2.23.0 before 2.23.4. CVE-2026-95811, disclosed by the CPAN Security Group, affects Lemonldap::NG::Handler from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4, where an equivalent spelling of a path can bypass locationRules meant to restrict it. None of the posts report observed exploitation. The reports do not disagree on version ranges, causes, or impacts.
- CVE-2026-92288 affects Lemonldap::NG::Portal for Perl from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4, allowing unauthenticated OAuth2 token introspection.
- CVE-2026-92289 affects Lemonldap::NG::Portal for Perl from 2.23.0 before 2.23.4 and allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode.
- Both Portal issues occur because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party; Timothy Legge posted them to oss-security.
- CVE-2026-95811 affects Lemonldap::NG::Handler for Perl from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4.
- An equivalent spelling of a path can bypass locationRules meant to restrict that path.
- The CPAN Security Group disclosed CVE-2026-95811; none of the three oss-security posts report in-the-wild exploitation.
Coverage timelineoldest first · each row is one article
- · 2d agoCVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
oss-security· 48
CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.
- · 2d agoCVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret
CVE-2026-92289 lets LemonLDAP::NG public OAuth clients bypass PKCE because client secrets are not verified.
- · 2d ago
Vulnerabilities in this storyAll →
- CVE-2026-922889.1—Unauthenticated OAuth2 token introspection in Lemonldap::NG::Portalpublished · Lemonldap::NG::Portal (Perl)+2 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-92288+2 related CVEs | Unauthenticated OAuth2 token introspection in Lemonldap::NG::Portal Lemonldap::NG::Portal fails to authenticate callers of its OAuth2 token introspection endpoint when the request names a Relying Party marked as public. The checkEndPointAuthenticationCredentials() routine skips the client secret comparison for public RPs yet still reports an authentication method (client_secret_basic or client_secret_post), so introspection() accepts any request carrying a public client_id with an arbitrary or empty secret. An attacker who holds any access token and knows a public client_id can confirm the token is active and read its metadata, including scope, audience, expiry, and the sub claim. Because sub is computed with the calling RP's user identifier attribute, an attacker can translate user identifiers between Relying Parties, defeating per-client and pseudonymous identifiers. No public proof of concept is known and there is no evidence of exploitation in the wild. |