CVE-2026-12804 is an open redirect vulnerability affecting lemonldap-ng versions up to 2.23.0. It is located in an unknown function within the SAML Common Domain Cookie Endpoint component, specifically in the lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm library. By manipulating the 'url' argument, an attacker can cause the application to redirect users to arbitrary external sites. The vulnerability is remotely exploitable without authentication and user interaction is required. The vendor has not issued any advisory or patch, and the exploit is publicly available.

Successful exploitation allows an attacker to redirect users to arbitrary URLs, potentially facilitating phishing attacks or redirecting users to malicious sites. There is no indication of direct code execution or data breach from this vulnerability. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

No official fix or patch is currently available from the vendor. Users should monitor vendor channels for updates. As a temporary mitigation, users may consider validating and sanitizing URL parameters in front-end or proxy layers to prevent open redirects. Since the vendor has not responded, caution is advised when handling untrusted input in the affected component.