CVE-2026-92288
Received Received - Intake

OAuth2 Token Introspection Flaw in Lemonldap::NG::Portal

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CPANSec

Description
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the authentication method deduced from the request, client_secret_basic or client_secret_post. introspection() rejects a caller only when that method is missing or none, so a request carrying a public client_id and an arbitrary or empty secret passes the endpoint's authentication check. An attacker who holds an access token and knows the client_id of any public Relying Party can confirm the token is active and read its metadata, including scope, audience, expiry and the sub claim. The sub claim is computed with the calling Relying Party's user identifier attribute, so an attacker can translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92288
EUVD
EUVD-2026-86487

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lemonldap ng_portal From 2.20.0 (inc) to 2.21.6 (exc)
lemonldap ng_portal From 2.22.0 (inc) to 2.23.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Lemonldap::NG::Portal versions before 2.21.6 and 2.23.4. It allows unauthenticated OAuth2 token introspection because the system fails to verify the client secret for public Relying Parties. Attackers with an access token and knowledge of a public client_id can confirm token validity and read metadata like scope, audience, and expiry.

Detection Guidance

To detect this vulnerability, inspect OAuth2 token introspection endpoints for improper client secret validation. Check if public Relying Parties bypass secret checks by examining server logs or configuration files for checkEndPointAuthenticationCredentials() behavior. Look for requests with public client_id and arbitrary/empty secrets that still return token metadata.

Impact Analysis

An attacker could confirm if a token is active and access its metadata, including user identifiers. This could allow translation of user identifiers between different systems, potentially linking pseudonymous or per-client identifiers to specific users.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR by enabling unauthorized access to user identifiers and token metadata. It may also breach HIPAA if protected health information is exposed through token introspection.

Mitigation Strategies

Upgrade LemonLDAP::NG::Portal to version 2.21.6 or later if using 2.20.x, or to 2.23.4 or later if using 2.22.x. Ensure all Relying Parties are reviewed and only public clients are marked as such if necessary. Verify OAuth2 token introspection endpoints enforce client secret validation for all clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart