The vulnerability in Lemonldap::NG::Portal arises because the function checkEndPointAuthenticationCredentials() does not verify the client secret for public Relying Parties, skipping secret comparison while still returning an authentication method. The introspection() function only rejects requests missing an authentication method, so requests with a public client_id and arbitrary or empty secret pass authentication. Consequently, an attacker possessing an access token and the client_id of any public Relying Party can introspect the token to confirm its activity and access sensitive metadata, including the sub claim, which is computed using the calling Relying Party's user identifier attribute. This allows attackers to correlate user identifiers across different Relying Parties, defeating intended pseudonymity and per-client isolation.

An attacker with an access token and knowledge of a public client_id can perform unauthenticated token introspection, confirming token validity and accessing sensitive token metadata such as scope, audience, expiry, and user identifiers. This compromises the confidentiality of token information and undermines user identifier pseudonymity across Relying Parties, potentially enabling user tracking or correlation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to tokens and client_ids of public Relying Parties and monitor for suspicious token introspection activity. Avoid exposing public client_ids and access tokens to untrusted parties.