EUVD-2026-86489
GHSA-vw4x-93xp-f6f3
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network attack (PR:N) yielding full token theft/account takeover (C:H/I:H), but requires first intercepting a victim's authorization code, so AC:H; no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
7DescriptionCVE.org
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret.
With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present.
An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode.
AnalysisAI
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the OIDC Relying Party to be a PUBLIC client configured with oidcRPMetaDataOptionsRequirePKCE set to 2 ('PKCE or secret' mode) on LemonLDAP::NG Portal versions 2.23.0 through 2.23.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication/authorization-logic flaw (CWE-1390, weak authentication) in the OIDC OpenID Provider of LemonLDAP::NG, not a memory-corruption or RCE issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LemonLDAP::NG::Portal to 2.23.4 or later, the vendor-released fixed version available from https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4, and apply the corresponding Debian/Ubuntu package updates once rebased (both distributions track the release, so prioritise internet-facing identity providers running packaged 2.23.0-2.23.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Patch available per vendor advisory; within 24 hours, inventory all LemonLDAP::NG::Portal deployments and identify any instance running version 2.23.0, 2.23.1, 2.23.2, or 2.23.3, prioritizing internet-facing and Dynamic Client Registration enabled systems; apply the vendor patch to the highest-risk instances immediately and, where patching cannot be completed, temporarily restrict public OIDC Relying Parties or enforce PKCE-only behavior if operationally viable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al
Same weakness CWE-1390 – Weak Authentication
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| resolute | needs-triage | - |
| upstream | released | 2.23.4+ds-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 2.16.1+ds-deb12u8 | - |
| bookworm (security) | vulnerable | 2.16.1+ds-deb12u9 | - |
| trixie (security), trixie | vulnerable | 2.21.2+ds-1+deb13u3 | - |
| sid | fixed | 2.23.4+ds-1 | - |
| (unstable) | fixed | 2.23.4+ds-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today