EUVD-2026-38190
GHSA-g4v8-q2mr-m933
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no privileges needed, user must click crafted link (UI:R); redirect yields low integrity impact only, no confidentiality or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the component SAML Common Domain Cookie Endpoint. Performing a manipulation of the argument url results in open redirect. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Open redirect in LemonLDAP::NG versions up to and including 2.23.0 allows unauthenticated remote attackers to manipulate the url argument within the SAML Common Domain Cookie (CDC) endpoint, causing authenticated SSO users to be silently forwarded to arbitrary attacker-controlled domains. The SSO context makes this particularly high-consequence for phishing: victims trust the identity provider's domain, lowering suspicion of the crafted redirect URL. Publicly available exploit code exists (CVSS 4.0 E:P); no vendor patch has been confirmed, as the vendor was unresponsive to responsible disclosure by VulDB.
Technical ContextAI
LemonLDAP::NG is an open-source Web SSO (Single Sign-On) middleware supporting SAML 2.0, OpenID Connect, and CAS federation. The vulnerability resides in the Common Domain Cookie (CDC) endpoint implemented in lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm. CDC is a SAML mechanism used to propagate authentication state across multiple organizational domains via a shared cookie. The url parameter accepted by this endpoint is insufficiently validated before being used as a redirect target - a classic CWE-601 (URL Redirection to Untrusted Site) root cause. Because the CDC endpoint is inherently internet-facing in federated SSO deployments (it must be reachable across domain boundaries), the attack surface is structurally broad. The CPE string (cpe:2.3:a:n/a:lemonldap-ng:*:*:*:*:*:*:*:*) reflects that all versions up through 2.23.0 carry this flaw across the entire 2.x release line.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure, and no fix version is confirmed in any available source. Defenders should apply the following compensating controls: first, implement input validation or an allowlist of permitted redirect targets on the CDC endpoint at the application layer or via a reverse proxy (e.g., nginx map or WAF rule) to reject url values pointing outside trusted organizational domains - note this may break legitimate cross-domain SSO federation flows if poorly scoped. Second, if SAML CDC functionality is not required by current federation partners, disable the CDC endpoint entirely in the LemonLDAP::NG portal configuration to eliminate the attack surface with no impact on non-CDC SAML flows. Third, monitor CDC endpoint access logs for unusual redirect targets as a detection measure. Organizations should track the upstream project repository for a patch release and prioritize upgrading immediately upon availability. Reference the VulDB advisory at https://vuldb.com/vuln/372598 for updated patch status.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today