LemonLDAP::NG EUVD-2026-38190

The CDC endpoint (lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm) must be enabled and network-accessible - this is a standard deployment configuration for organizations using LemonLDAP::NG in a multi-domain SAML federation context, making it a default-accessible attack surface. No authentication is required (PR:N): the attacker only needs to send a crafted HTTP request with a manipulated url parameter. Exploitation requires passive user interaction (UI:P): the victim must click or follow a crafted link. Exploitation is limited to victims running lemonldap-ng versions 2.0 through 2.23.0 on the server side. The attacker does not need any existing account, session, or elevated access. Organizations that have disabled the SAML CDC feature or deployed strict redirect-target allowlists at a reverse-proxy layer are not exploitable via this path.

The raw CVSS 4.0 score of 2.1 significantly understates operational risk for organizations using LemonLDAP::NG as their identity provider. The vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms remote, low-complexity, unauthenticated exploitation requiring only passive user interaction - a single click on a crafted link. The low score is driven by an impact ceiling of VI:L with no confidentiality or availability impact in the CVSS model, but this understates real-world consequence: in an SSO context, a trusted redirect from the IdP domain is an exceptionally effective phishing lure that can yield credential theft against the broader service portfolio protected by that SSO. The E:P threat metric confirms publicly available proof-of-concept code, raising exploitation likelihood above baseline. No CISA KEV listing means active in-the-wild exploitation is not confirmed, but the combination of trivial exploitation, public PoC, and absent vendor patch creates meaningful urgency for defenders. EPSS data is not provided in the input; its absence should not be interpreted as low exploitation probability. The vendor's non-response to responsible disclosure is a compounding factor, eliminating the possibility of coordinated patching guidance.

An attacker crafts a URL targeting the LemonLDAP::NG CDC endpoint appended with a malicious url parameter pointing to an attacker-controlled phishing site visually mimicking the organization's SSO portal. The attacker distributes this link via a spear-phishing email to employees, relying on the trusted identity provider domain in the URL to bypass suspicion. When a victim clicks the link, CDC.pm performs no domain validation and silently forwards the user to the attacker's credential-harvesting page. A public PoC lowers the technical bar for this attack.