Secuno
ENNL
Book demo

CVE-2026-92289

Lemonldap::NG::Portal vulnerability

9.1 CRITICALEPSS 0.39%
  1. Published24 Sept 2026

Description

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present. An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-969408.8
An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web…
CVE-2026-933558.1
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a…
CVE-2026-922889.1
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for…
CVE-2026-774838.8
Weak authentication in SQL Server allows an authorized attacker to elevate privileges…
CVE-2026-730259.8
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a…
CVE-2026-628958.8
Permissive cross-domain policy with untrusted domains in Azure Arc allows an…

Frequently asked

Is CVE-2026-92289 being actively exploited?

CVE-2026-92289 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.39%.

How severe is CVE-2026-92289?

CVE-2026-92289 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.39% probability of exploitation.

How do I fix CVE-2026-92289?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-92289 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.