CVE-2026-92288 lemonldap-ng CVE debrief

Who should care

Defenders responsible for Lemonldap::NG::Portal instances, especially those with public Relying Parties, should assess exposure and potential impact. They should verify the exposure of their instances, review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-92288 is a critical vulnerability in Lemonldap::NG::Portal that allows unauthenticated OAuth2 token introspection, potentially leading to token metadata disclosure and identifier translation.

• An attacker can confirm the activity of an access token and read its metadata, including scope, audience, expiry, and the sub claim.
• The sub claim can be used to translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers.
• Defenders need to verify exposure of Lemonldap::NG::Portal instances and assess the potential impact of token metadata disclosure.
• Remediation priority is high for instances with public Relying Parties.

Technical summary

The checkEndPointAuthenticationCredentials function in Lemonldap::NG::Portal does not verify the client secret of a public Relying Party, allowing an attacker to confirm the activity of an access token and read its metadata, including scope, audience, expiry, and the sub claim. This vulnerability affects versions 2.20.0 to 2.21.6 and 2.22.0 to 2.23.4 of Lemonldap::NG::Portal for Perl, potentially leading to token metadata disclosure and identifier translation. Defenders should prioritize verifying exposure of Lemonldap::NG::Portal instances, especially those with public Relying Parties, and assess the potential impact of token metadata disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Lemonldap::NG::Portal instances, especially those with public Relying Parties, and assess the potential impact of token metadata disclosure.

Recommended defensive actions

• Verify exposure of Lemonldap::NG::Portal instances, especially those with public Relying Parties
• Assess the potential impact of token metadata disclosure
• Update to version 2.21.6 or 2.23.4, or apply patches as recommended by the vendor
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the vendor and product names are not specified, and the confidence level is low.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.