Threats tagged 'ghsa-vw4x-93xp-f6f3'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.1	EPSS 0.5%	CVE-2026-92289 · Weak Authentication Critical9.1EPSS 0.5%2026-09-25CVE Database V5 CVE-2026-92289 is a critical vulnerability in Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl. It allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode due to improper verification of the client secret. An attacker who intercepts an authorization code can exchange it for user tokens by replaying the client_id with any secret, bypassing PKCE protections. EPSS 0.5%Vulnerability CWE-1390 #ghsa-vw4x-93xp-f6f3	CVE Database V5	2026-09-25

Page 1 of 1