CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party.
checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the authentication method deduced from the request, clientsecretbasic or clientsecretpost. introspection() rejects a caller only when that method is missing or none, so a request carrying a public clientid and an arbitrary or empty secret passes the endpoint's authentication check.
An attacker who holds an access token and knows the clientid of any public Relying Party can confirm the token is active and read its metadata, including scope, audience, expiry and the sub claim. The sub claim is computed with the calling Relying Party's user identifier attribute, so an attacker can translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lemonldap::NG::Portalto a version that resolves this vulnerability.Fixed in 2.23.4
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Lemonldap::NG::Portal for Perl from 2.20.0 before 2.21.6 and from 2.22.0 before 2.23.4. Exploitation depends on the presence of at least one Relying Party configured as public.
What does an attacker need to exploit this issue?
The attacker needs an access token and the client_id of any public Relying Party. They can submit that public client_id with an arbitrary or empty secret using client_secret_basic or client_secret_post.
What information can be exposed through the introspection endpoint?
An attacker can determine whether the token is active and obtain metadata including its scope, audience, expiry, and sub claim. Because sub is derived using the calling Relying Party's user identifier attribute, this can enable translation of a user's identifier between Relying Parties.
What can be done if upgrading is not immediately possible?
The provided information identifies public Relying Parties as the condition that permits exploitation. Review whether public Relying Parties are configured and treat access tokens and their introspection metadata as exposed where an attacker could obtain a token and a public client_id.