Threats tagged 'ghsa-pxfv-p3g7-3fw3'

CVE-2026-92288 is a critical vulnerability in Lemonldap::NG::Portal versions >=2.20.0 <2.21.6 and >=2.22.0 <2.23.4. It allows unauthenticated OAuth2 token introspection due to weak authentication checks for public Relying Parties. An attacker with an access token and knowledge of a public client_id can confirm token validity and read sensitive token metadata, including user identifiers, potentially correlating user identities across clients.