Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

LemonLDAP::NG allows login bypass via GitHub or LinkedIn

CVE-2026-19349 · published 2 months ago
Summary

Certain versions of the LemonLDAP::NG portal can let an unauthenticated user gain access without entering a password when the GitHub or LinkedIn login option is enabled. A temporary identifier created during the sign‑in redirect can be reused as a valid session cookie, giving the attacker access. Upgrade to the latest LemonLDAP::NG release (or apply the vendor’s patch) and consider disabling the GitHub and LinkedIn authentication modules until the upgrade is completed.

What to do
  • Update debian lemonldap-ng to version 2.0.11+ds-4+deb11u9.
  • Update debian lemonldap-ng to version 2.16.1+ds-deb12u9.
  • Update debian lemonldap-ng to version 2.21.2+ds-1+deb13u3.
  • Update debian lemonldap-ng to version 2.23.3+ds-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian lemonldap-ng < 2.0.11+ds-4+deb11u9
Fix: upgrade to 2.0.11+ds-4+deb11u9
Debian:12 debian lemonldap-ng < 2.16.1+ds-deb12u9
Fix: upgrade to 2.16.1+ds-deb12u9
Debian:13 debian lemonldap-ng < 2.21.2+ds-1+deb13u3
Fix: upgrade to 2.21.2+ds-1+deb13u3
Debian:14 debian lemonldap-ng < 2.23.3+ds-1
Fix: upgrade to 2.23.3+ds-1
Ubuntu:16.04:LTS canonical lemonldap-ng All versions
Original advisory text
Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends
Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the state session with the positional call `getApacheSession( undef, 1, 0, 'GitHubState' )`. getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a "default => accept" access rule; deployments whose rules test the user or require an authentication level are less exposed. Only configurations with the GitHub or LinkedIn authentication module enabled are affected.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-305Authentication Bypass by Primary Weakness
CWE-628Function Call with Incorrectly Specified Arguments
Timeline
Published16 Aug 2026
Updated7 Nov 2026
First seen11 Aug 2026
Sources
DEBIAN-CVE-2026-19349 · OSV
CVE-2026-19349 · MITRE
CVE-2026-19349 · NVD
UBUNTU-CVE-2026-19349 · OSV
CVE-2026-19349 · OSV
Track software like this
Free during beta