Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, and from 2.22.0 before 2.23.3 for Perl contain an authentication bypass vulnerability via the OAuth2 state parameter in the GitHub and LinkedIn backends. The function extractFormInfo() creates the state session using getApacheSession() with arguments that cause the state to be stored as a regular SSO session. This session identifier is then exposed to unauthenticated visitors as the OAuth2 state parameter. An attacker can replay this identifier as a session cookie to obtain a valid SSO session without authentication. The session lacks _user and authenticationLevel attributes, but default bootstrap configurations that accept "default => accept" access rules allow unauthorized access. Deployments that enforce user or authentication level checks are less impacted.

An attacker can bypass authentication and gain unauthorized access to Lemonldap::NG::Portal protected resources by replaying the OAuth2 state parameter session identifier. This leads to a full compromise of the SSO session, potentially exposing sensitive information and allowing unauthorized actions. The impact is critical due to the complete authentication bypass and high CVSS score (9.8). However, the vulnerability only affects configurations using the GitHub or LinkedIn authentication modules and those with permissive access rules that do not verify user identity or authentication level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should review their access control rules to ensure they do not rely on the default "default => accept" setting and instead enforce user identity and authentication level checks. Additionally, consider disabling the GitHub and LinkedIn authentication modules if not required. Monitor vendor communications for official patches or updates addressing this vulnerability.