Skip to content
OpenAdvisories

Package · Debian

lemonldap-ng

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-92289

    Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

    Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE s…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.1
    CVE-2026-92288

    Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

    Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndP…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.8
    CVE-2026-19349

    Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

    Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting t…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.1
    CVE-2021-35473

    An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.1
    CVE-2024-45160

    Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 clie…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.8
    CVE-2019-19791

    In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restri…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.8
    CVE-2023-28862

    An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorre…

    lemonldap-ng lemonldap-ng Debian Ubuntu