Threats affecting pkg:github/lemonldap-ng/lemonldap-ng

CVE-2026-19349 is a critical authentication bypass vulnerability in Lemonldap::NG::Portal affecting certain versions that use the GitHub and LinkedIn OAuth2 backends. The flaw allows an unauthenticated visitor to replay a session identifier used as an OAuth2 state parameter to gain a valid SSO session without proper authentication. This occurs because the state parameter is stored as a regular SSO session lacking user and authentication level attributes, which some default configurations accept. Only deployments with the GitHub or LinkedIn authentication modules enabled are affected.

A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the component SAML Common Domain Cookie Endpoint. Performing a manipulation of the argument url results in open redirect. The attack is possible to be carried out remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue. The vendor confirms, that "it has been fixed some days ago and will be available in 2.23.1. CDC is quite never used, so the impact is very low."

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.

LemonLDAP::NG versions prior to 2.20.1 contain a cross-site scripting (XSS) vulnerability in the upgrade session confirmation page when the "Upgrade session" plugin is enabled. This flaw allows remote attackers with limited privileges to inject arbitrary web scripts or HTML via the url parameter, potentially leading to script execution in the context of the affected application.

CVE-2024-52946 is a vulnerability in LemonLDAP::NG versions prior to 2.20.1. It involves an improper check during session refresh that allows an authenticated user to escalate their authentication level if the administrator has configured an adaptive authentication rule using an increment rather than an absolute value.

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).

A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.