CVE-2026-92289 Lemonldap NG CVE debrief

Who should care

Defenders responsible for Lemonldap::NG::Portal deployments, particularly those using public Relying Parties in 'PKCE or secret' mode, should assess their exposure and apply the patch to prevent potential token exchanges.

Why it matters

Defenders should care about CVE-2026-92289 because it allows a PKCE bypass, potentially enabling unauthorized access to user tokens. Those responsible for Lemonldap::NG::Portal deployments, especially with public Relying Parties in 'PKCE or secret' mode, should verify their version, apply the patch, and review authentication configurations to prevent potential token exchanges.

• Potential token exchange for unauthorized access
• Need to verify and update authentication configurations
• Possible impact on user access and refresh tokens

Technical summary

The vulnerability allows an attacker to bypass the Proof Key for Code Exchange (PKCE) mechanism for public Relying Parties in 'PKCE or secret' mode. This is possible because the checkEndPointAuthenticationCredentials function does not verify the client secret, enabling an attacker to exchange an intercepted authorization code for the user's tokens. The issue arises in Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl, affecting deployments using public Relying Parties in 'PKCE or secret' mode. Defenders should prioritize verifying their Lemonldap::NG::Portal version and applying the patch to prevent potential token exchanges.

Defensive priority

Defenders should prioritize verifying their Lemonldap::NG::Portal version and applying the patch to prevent potential token exchanges.

Recommended defensive actions

• Verify Lemonldap::NG::Portal version and apply patch if necessary
• Review and update authentication configurations for public Relying Parties
• Monitor for potential token exchange attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl, allowing a PKCE bypass for public Relying Parties in 'PKCE or secret' mode. However, the scope of affected systems and potential impact require further verification and defensive analysis to understand the extent of exposure and necessary mitigations. Defenders should verify their version, review authentication configurations, and monitor for potential token exchange attempts. The CVE Program and NVD

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.