CVE-2026-19349 Lemonldap::NG CVE debrief

Who should care

Administrators and users of Lemonldap::NG::Portal, especially those with GitHub or LinkedIn authentication modules enabled, should verify their systems and apply patches to prevent authentication bypass attacks. This includes reviewing current configurations, ensuring that access rules are appropriately set, and monitoring for any suspicious activity that could indicate exploitation attempts.

Technical summary

The Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, and from 2.22.0 before 2.23.3 are vulnerable to authentication bypass via an OAuth2 state parameter stored as an SSO session in GitHub and LinkedIn backends. The vulnerability arises from the mishandling of the state session in the extractFormInfo() function, allowing any visitor to replay the identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a 'default => accept' access rule; deployments whose rules test the user or require an authentication level are less exposed.

Defensive priority

Authentication bypass vulnerability in Lemonldap::NG::Portal via OAuth2 state parameter; verify and apply vendor patches.

Recommended defensive actions

• Verify affected Lemonldap::NG::Portal versions and apply patches
• Restrict access to GitHub and LinkedIn authentication modules
• Monitor for suspicious authentication attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-19349 vulnerability affects Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, and from 2.22.0 before 2.23.3. The vulnerability allows authentication bypass via an OAuth2 state parameter stored as an SSO session in GitHub and LinkedIn backends. Limited information available on exploitation; verify affected systems and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.