These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-95811 is a vulnerability in Lemonldap::NG::Handler that allows an attacker to bypass locationRules by percent-encoding a character of the path, inserting dot segments, or doubling a slash. This affects versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4. Only a vhost whose default rule is more permissive than its other rules is affected.
CVE-2026-92289 is a vulnerability in Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl, allowing a PKCE bypass for public Relying Parties in 'PKCE or secret' mode. This issue arises because checkEndPointAuthenticationCredentials does not verify the client secret. An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID, and [truncated]
CVE-2026-92288 is a critical vulnerability in Lemonldap::NG::Portal that allows unauthenticated OAuth2 token introspection. An attacker with an access token and the client_id of a public Relying Party can confirm the token's activity and read its metadata, including scope, audience, expiry, and the sub claim. This vulnerability affects versions 2.20.0 to 2.21.6 and 2.22.0 to 2.23.4 of Lemonldap::NG::Portal for Perl.
The Lemonldap::NG::Portal, specifically versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, and from 2.22.0 before 2.23.3, is vulnerable to an authentication bypass attack via an OAuth2 state parameter stored as an SSO session in GitHub and LinkedIn backends. This vulnerability arises from the mishandling of the state session in the extractFormInfo() function, allowing any visitor to replay the [truncated]