CVE-2026-12804: LemonLDAP-NG Open Redirect Vulnerability

CVE-2026-12804 Overview

CVE-2026-12804 is an open redirect vulnerability in LemonLDAP::NG, an open-source web Single Sign-On (SSO) and access management framework. The flaw resides in the lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm library that implements the SAML Common Domain Cookie (CDC) endpoint. An attacker can manipulate the url argument to redirect authenticated users to attacker-controlled destinations. The vulnerability affects LemonLDAP::NG releases up to and including version 2.23.0, and the issue is tracked under CWE-601: URL Redirection to Untrusted Site. The vendor has confirmed the issue and states a fix will ship in version 2.23.1.

Critical Impact
Remote attackers can craft malicious links that abuse the SAML CDC endpoint to redirect victims to phishing pages, enabling credential theft and downstream social-engineering attacks.

Affected Products

LemonLDAP::NG versions up to and including 2.23.0
The Lemonldap::NG::Portal::CDC Perl module
Deployments exposing the SAML Common Domain Cookie endpoint

Discovery Timeline

2026-06-21 - CVE-2026-12804 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12804

Vulnerability Analysis

LemonLDAP::NG implements the SAML Common Domain Cookie protocol to allow identity provider discovery across federated SAML deployments. The CDC endpoint, implemented in CDC.pm, accepts a url parameter to direct the browser after the cookie is read or written. The endpoint does not properly validate that the supplied URL belongs to a trusted domain or matches an allow-list of redirection targets. As a result, the parameter can be set to an arbitrary external location, and the portal will issue an HTTP redirect to that destination. Because the redirect originates from a trusted SSO portal, victims are more likely to trust the resulting landing page.

Root Cause

The root cause is missing or insufficient validation of the url request parameter inside the CDC handler. The code path uses the attacker-supplied value as a redirection target without verifying its scheme, host, or membership in a configured allow-list. This is a classic CWE-601 URL redirection weakness. The vendor noted that the CDC component is rarely deployed in production, which limits real-world exposure but does not eliminate risk for federations that rely on it.

Attack Vector

Exploitation requires user interaction. An attacker crafts a link to the vulnerable CDC endpoint with the url parameter pointing at a malicious site, then delivers it via email, chat, or a malicious web page. When a victim clicks the link, the LemonLDAP::NG portal redirects the browser off-platform. The technique is commonly chained with phishing kits that clone the legitimate SSO login page to harvest credentials or SAML assertions. No authentication is required to issue the request, and the public proof-of-concept is referenced in the VulDB entry for CVE-2026-12804.

No verified exploit code is reproduced here. See the GitLab merge request 979 for the upstream fix.

Detection Methods for CVE-2026-12804

Indicators of Compromise

Requests to the SAML CDC endpoint containing a url parameter whose host does not match the federation's configured domains.
HTTP 302 responses from LemonLDAP::NG to external hosts referenced via the url query parameter.
Spike in inbound clicks to the CDC endpoint from email, messaging, or social-media referrers.

Detection Strategies

Inspect reverse-proxy and portal access logs for CDC.pm invocations and compare the url parameter against an allow-list of expected partner domains.
Alert on redirects from the SSO portal that resolve to newly registered, low-reputation, or non-corporate domains.
Correlate CDC redirect events with subsequent authentication failures or unusual login attempts that may indicate credential harvesting.

Monitoring Recommendations

Forward LemonLDAP::NG portal logs and upstream web server logs to a centralized log platform for query and retention.
Build a dashboard tracking unique url parameter values seen on the CDC endpoint over time.
Integrate phishing-domain threat intelligence feeds to flag redirect targets that match known malicious infrastructure.

How to Mitigate CVE-2026-12804

Immediate Actions Required

Upgrade LemonLDAP::NG to version 2.23.1 or later as soon as it is published by the OW2 project.
If the SAML Common Domain Cookie feature is not in use, disable the CDC endpoint at the portal configuration or web server layer.
Restrict access to the CDC endpoint via reverse-proxy rules that validate the url parameter against an allow-list of federated partner domains.

Patch Information

The fix is merged upstream and tracked in GitLab merge request 979 and work item 3619. The vendor confirms the issue will be available in LemonLDAP::NG 2.23.1. Administrators running the Debian, RPM, or container distributions should monitor their respective package repositories for the updated release and apply it through normal change-management processes.

Workarounds

Block external HTTP redirects from the portal at the reverse proxy by enforcing a Location header allow-list.
Remove or comment out the CDC route in the portal configuration if Common Domain Cookie discovery is not required.
Educate users to verify the final destination URL after clicking SSO-related links, particularly those received via email.

bash

# Example nginx snippet to block CDC requests with off-domain url parameters
location /saml/cdc {
    if ($arg_url !~* "^https://([a-z0-9.-]+\.)?example\.com(/|$)") {
        return 400;
    }
    proxy_pass http://lemonldap_backend;
}