CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

As cited

Copy frozen at 2026-09-25 03:53 UTC (site build).

vulnerabilities

CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

CVE-2026-92289 affects Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 for Perl, where the checkEndPointAuthenticationCredentials function fails to validate client secrets in PKCE or secret mode. This oversight enables proof key for code exchange (PKCE) bypass attacks against public relying parties. The vulnerability is resolved in version 2.23.4.

Why it matters: Organizations running affected Lemonldap::NG::Portal versions should upgrade immediately, as attackers can bypass authentication for public relying parties and potentially gain unauthorized access to protected resources.

Source published

2026-09-25 00:41 UTC

First seen by Cybersecurity Tracker

2026-09-25 01:20 UTC