CVE-2026-92289
Received Received - Intake

PKCE Bypass in Lemonldap::NG::Portal

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CPANSec

Description
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present. An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92289
EUVD
EUVD-2026-86489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemonldap ng_portal From 2.23.0 (inc) to 2.23.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Lemonldap::NG::Portal versions 2.23.0 to 2.23.4 allows an attacker to bypass PKCE (Proof Key for Code Exchange) protection for public Relying Parties. The issue occurs when the system is configured in 'PKCE or secret' mode. The authorization endpoint may issue a code without requiring a code challenge, and the token endpoint accepts the code exchange even if no challenge was stored or verified. This defeats the purpose of PKCE, which is designed to prevent authorization code interception attacks.

Detection Guidance

To detect this vulnerability, inspect LemonLDAP::NG Portal configurations for public Relying Parties with oidcRPMetaDataOptionsRequirePKCE set to 2. Check if checkEndPointAuthenticationCredentials skips secret verification for public clients. Review logs for authorization codes issued without code_challenge.

Impact Analysis

An attacker who intercepts an authorization code issued to a public Relying Party can exploit this flaw to exchange the code for the user's access, ID, and refresh tokens. This is possible by replaying the client_id with an arbitrary secret. The impact includes unauthorized access to user accounts, potential data breaches, and loss of control over sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating principles of data protection under GDPR and HIPAA. It may result in non-compliance with requirements for secure authentication, data confidentiality, and breach notification, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade LemonLDAP::NG Portal to version 2.23.4 or later. Disable public Relying Parties or ensure oidcRPMetaDataOptionsRequirePKCE is not set to 2. Enforce PKCE for all clients by requiring code_challenge in authorization requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart