CVE-2026-92289: LemonLDAP NG Portal 2.23.0‑2.23.3 may let attackers bypass login check

The LemonLDAP NG Portal versions from 2.23.0 up to 2.23.3 do not correctly verify a secret when using the PKCE (Proof Key for Code Exchange) flow, allowing a public client to obtain an authentication token without proper proof. This could let an unauthorized user gain access to protected applications. Update the portal to version 2.23.4 or later and confirm the configuration follows the recommended security guidance.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• http://www.openwall.com/lists/oss-security/2026/09/25/2 URL
• https://security-tracker.debian.org/tracker/CVE-2026-92289 Vendor Advisory
• https://ubuntu.com/security/CVE-2026-92289 Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-92289 Third Party Advisory
• https://cpan.org/modules URL
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92289... Vendor Advisory
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4 Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-92289 Vendor Advisory
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng Product
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719 Third Party Advisory