Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

LemonLDAP::NG Portal and Handler flaws disclosed

1 source · 2 articlesFirst reported Updated ()3
What's new

The newest report adds CVE-2026-95811 in Lemonldap::NG::Handler, a locationRules bypass via equivalent path spellings in ranges ending before 2.16.10, 2.21.6, and 2.23.4, disclosed by the CPAN Security Group beyond the two earlier Portal OAuth issues.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Three oss-security advisories describe LemonLDAP::NG Portal OAuth secret-check failures and a Handler path-rule bypass, with no reported exploitation.

On 2026-09-25, oss-security carried three advisories for Perl components of LemonLDAP::NG. CVE-2026-92288 and CVE-2026-92289, posted by Timothy Legge, share a failure in checkEndPointAuthenticationCredentials to verify the client secret of a public Relying Party: the first allows unauthenticated OAuth2 token introspection in Portal versions from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4, and the second is a PKCE bypass for public Relying Parties in "PKCE or secret" mode in Portal versions from 2.23.0 before 2.23.4. CVE-2026-95811, disclosed by the CPAN Security Group, affects Lemonldap::NG::Handler from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4, where an equivalent spelling of a path can bypass locationRules meant to restrict it. None of the posts report observed exploitation. The reports do not disagree on version ranges, causes, or impacts.

Key facts
  • CVE-2026-92288 affects Lemonldap::NG::Portal for Perl from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4, allowing unauthenticated OAuth2 token introspection.
  • CVE-2026-92289 affects Lemonldap::NG::Portal for Perl from 2.23.0 before 2.23.4 and allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode.
  • Both Portal issues occur because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party; Timothy Legge posted them to oss-security.
  • CVE-2026-95811 affects Lemonldap::NG::Handler for Perl from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4.
  • An equivalent spelling of a path can bypass locationRules meant to restrict that path.
  • The CPAN Security Group disclosed CVE-2026-95811; none of the three oss-security posts report in-the-wild exploitation.
Analyze CVE-2026-95811 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-95811CVE-2026-92288CVE-2026-92289
Vendors
LemonLDAP::NG
Products
Lemonldap::NG::HandlerLemonLDAP::NG Portal
Organizations
CPAN Security Group

Coverage

oldest first · one row per article · UTC
  1. · Sep 25, 2026 oss-securityFirst report

    CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

    CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.

  2. · Sep 25, 2026 oss-security

    CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

    CVE-2026-92289 lets LemonLDAP::NG public OAuth clients bypass PKCE because client secrets are not verified.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-92288
+2 related CVEs
CVE-2026-92289CVE-2026-95811
Unauthenticated OAuth2 token introspection in Lemonldap::NG::Portal
9.1
group max
—