CVE-2026-19349 is an authentication bypass vulnerability in Lemonldap::NG::Portal affecting versions 2.0.0, 2.17.0, and 2.22.0. The issue stems from the OAuth2 state parameter being stored as a standard SSO session via a positional call to getApacheSession() that misinterprets arguments, causing the state to be written globally as an SSO session. An unauthenticated visitor can replay the session identifier as a cookie at the GitHub or LinkedIn endpoint to obtain a valid SSO session without authenticating. The session lacks user and authentication level attributes, but the default bootstrap configuration grants access based on a "default => accept" rule, making some deployments more vulnerable than others depending on their access control rules.

An attacker who can reach the GitHub or LinkedIn OAuth2 endpoint can bypass authentication by replaying a session identifier, gaining unauthorized access to a valid SSO session. This could allow unauthorized access to resources protected by Lemonldap::NG::Portal when using the affected authentication modules. The impact depends on the deployment's access control configuration; those relying on default accept rules are more exposed, while deployments requiring user or authentication level checks are less affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should review and tighten access control rules to avoid relying on default accept rules and ensure authentication level or user presence is required. Disabling the GitHub and LinkedIn authentication modules if not needed can also reduce exposure.