What is the CVSS score of EUVD-2026-59963?

EUVD-2026-59963 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LemonLDAP::NG are affected by EUVD-2026-59963?

LemonLDAP::NG, a widely-used identity authentication platform, contains a critical vulnerability (CVE-2026-19349) that enables unauthenticated remote authentication bypass, allowing attackers to…

How to fix or mitigate EUVD-2026-59963?

Within 24 hours: identify and inventory all LemonLDAP::NG deployments across versions 2.16.x, 2.21.x, and 2.23.x, noting which systems are internet-facing. Within 7 days: apply vendor-released patches by upgrading to LemonLDAP::NG 2.16.9, 2.21.5, or 2.23.3 (or later) to all identified instances, prioritizing internet-facing systems. Within 30 days: complete patch verification across all systems, review authentication logs for unauthorized access attempts, and confirm full remediation.

LemonLDAP::NG EUVD-2026-59963

| CVE-2026-19349 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-08-13 vendor:ubuntu

GHSA-4vx7-c7qw-2vx4

Information Disclosure

9.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable auth bypass with no privileges gives AV:N/AC:L/PR:N; the information-disclosure tag makes confidentiality primary (C:H), with only limited integrity and no confirmed availability impact from the sparse description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 17:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 17:22 NVD

9.8 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 16:40 vuln.today

DescriptionCVE.org

security update

AnalysisAI

Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) despite the 9.8 CVSS.

Technical ContextAI

LemonLDAP::NG is an open-source WebSSO, access management, and identity federation platform (OW2 project) commonly deployed as a Perl-based reverse-proxy/handler in front of web applications, supporting SAML, OpenID Connect, and CAS. The assigned weakness is CWE-305 (Authentication Bypass by Primary Weakness), meaning the product's main authentication mechanism can be circumvented rather than a secondary/alternate path being abused. Combined with the 'Information Disclosure' tag, the root cause class points to a flaw in how the primary authentication decision is enforced, potentially allowing access to resources that should require a valid session. No CPE strings were supplied in the input, so exact affected configurations must be read from the vendor release notes.

Affected ProductsAI

The affected product is LemonLDAP::NG, the OW2 WebSSO and access management software. Based on the fixed releases published on the OW2 GitLab, the 2.23.x branch is fixed in 2.23.3, the 2.21.x branch in 2.21.5, and the 2.16.x branch in 2.16.9, implying earlier releases across each of these branches are vulnerable; exact lower bounds are not stated in the provided data and no CPE strings were supplied. Vendor advisories: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.3 , https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.5 , and https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.9 . Distribution coverage was provided by Ubuntu.

RemediationAI

Vendor-released patch: upgrade to LemonLDAP::NG 2.23.3, 2.21.5, or 2.16.9 depending on your installed branch (see the OW2 GitLab release pages linked above and the disclosure at https://seclists.org/oss-sec/2026/q3/505 ). Ubuntu users should apply the corresponding distribution security update. If immediate patching is not possible, compensating controls should reflect that the flaw is in the primary authentication path: restrict network exposure of the LemonLDAP::NG portal/handler to trusted networks or place it behind an additional authenticating reverse proxy or VPN (trade-off: breaks external SSO access for legitimate remote users), and increase session/authentication logging to detect anomalous access while the fix is pending. Because the exact vulnerable mechanism is not described in the available data, these controls are risk-reducing but cannot be guaranteed to fully block the bypass - patching is the only confirmed remediation.