EUVD-2026-86487
GHSA-pxfv-p3g7-3fw3
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated call to the introspection endpoint (AV:N/AC:L/PR:N/UI:N); impact is disclosure of token metadata and identifier correlation so C:H, with no modification (I:N) or availability effect (A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party.
checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the authentication method deduced from the request, client_secret_basic or client_secret_post. introspection() rejects a caller only when that method is missing or none, so a request carrying a public client_id and an arbitrary or empty secret passes the endpoint's authentication check.
An attacker who holds an access token and knows the client_id of any public Relying Party can confirm the token is active and read its metadata, including scope, audience, expiry and the sub claim. The sub claim is computed with the calling Relying Party's user identifier attribute, so an attacker can translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers.
AnalysisAI
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a LemonLDAP::NG Portal running the OAuth2/OIDC provider with at least one Relying Party configured as 'public' (no client authentication), and (2) the attacker to already hold a valid access token plus knowledge of that public RP's client_id. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input signals point to a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to LemonLDAP::NG 2.21.6 (2.21.x branch) or 2.23.4 (2.22/2.23 branch); both are published on the vendor's GitLab releases at https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6 and https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4, with the underlying fixes tracked in work items https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719 and https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3721 and described in the oss-security advisory at https://seclists.org/oss-sec/2026/q3/933. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of LemonLDAP::NG Portal and apply the vendor-released patch versions 2.21.6 or 2.23.4 to any internet-facing or high-risk deployments; if immediate patching is not possible, restrict access to the introspection endpoint to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al
Same weakness CWE-1390 – Weak Authentication
View allSame technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| resolute | needs-triage | - |
| upstream | released | 2.23.4+ds-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 2.16.1+ds-deb12u8 | - |
| bookworm (security) | vulnerable | 2.16.1+ds-deb12u9 | - |
| trixie (security), trixie | vulnerable | 2.21.2+ds-1+deb13u3 | - |
| sid | fixed | 2.23.4+ds-1 | - |
| (unstable) | fixed | 2.23.4+ds-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today