CVE-2026-92288: Lemonldap::NG::Portal Auth Bypass Vulnerability

CVE-2026-92288 Overview

CVE-2026-92288 is an authentication bypass in the LemonLDAP::NG Portal OAuth2 token introspection endpoint. The flaw affects Lemonldap::NG::Portal versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4 for Perl. The checkEndPointAuthenticationCredentials() function skips the client secret comparison when a Relying Party is marked as public. An attacker who holds any access token and knows the client_id of a public Relying Party can call /oauth2/introspect and read token metadata. Disclosed data includes scope, audience, exp, and the sub claim, enabling cross-Relying-Party subject correlation [CWE-1390].

Critical Impact
Unauthenticated callers can confirm access tokens are active and read sub claims, breaking per-client pseudonymous identifiers across federated applications.

Affected Products

Lemonldap::NG::Portal 2.20.0 before 2.21.6 (Perl)
Lemonldap::NG::Portal 2.22.0 before 2.23.4 (Perl)
Any deployment with at least one OAuth2 public Relying Party registered

Discovery Timeline

2026-09-25 - CVE-2026-92288 published to NVD
2026-09-25 - Public discussion on the Openwall oss-security list
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-92288

Vulnerability Analysis

The LemonLDAP::NG Portal implements OAuth2 token introspection per RFC 7662. The introspection endpoint must authenticate callers before returning token metadata. In the affected releases, checkEndPointAuthenticationCredentials() bypasses the client secret comparison whenever the resolved Relying Party is marked public. The function still returns the authentication method deduced from the HTTP request, either client_secret_basic or client_secret_post. The introspection() handler only rejects callers when the returned method is missing or none. A request carrying a public client_id and any arbitrary or empty secret therefore satisfies the endpoint's authentication check.

The sub claim returned by introspection is computed using the calling Relying Party's user identifier attribute. An attacker who introspects the same token against two different public Relying Parties can translate a user identifier from one application to another. This defeats pseudonymous subject identifiers and per-client subject scoping, both of which are core privacy guarantees of OpenID Connect.

Root Cause

The root cause is an incomplete authentication check for public OAuth2 clients at the introspection endpoint. Public clients cannot hold a secret, so the correct behavior is to reject them from introspection entirely or require a bearer access token with explicit introspection scope. Instead, checkEndPointAuthenticationCredentials() short-circuits and signals success, and the downstream introspection() handler trusts the deduced method as proof of authentication.

Attack Vector

Exploitation requires network reach to the Portal's /oauth2/introspect endpoint and knowledge of a public client_id. The attacker also needs an access token value, which may be captured from a browser session, a log file, a referrer header, or a compromised client. The attacker submits an HTTP POST with the public client_id, an empty or arbitrary client_secret, and the token parameter. The Portal returns the full introspection response, confirming token validity and exposing scope, aud, exp, and sub.

No verified exploit code is published. See the LemonLDAP-ng Work Item #3719 and Work Item #3721 for upstream technical context.

Detection Methods for CVE-2026-92288

Indicators of Compromise

POST requests to /oauth2/introspect carrying a client_id of a registered public Relying Party with an empty or clearly invalid client_secret.
High volumes of introspection calls from a single source IP, especially across multiple client_id values.
Introspection requests originating from IP ranges that do not match any configured resource server.

Detection Strategies

Parse Portal access logs for /oauth2/introspect requests and correlate the client_id against the registry of public versus confidential Relying Parties.
Alert on introspection responses with active:true returned to clients outside expected resource server networks.
Baseline normal introspection volume per Relying Party and flag deviations.

Monitoring Recommendations

Forward Portal and reverse proxy logs to a centralized analytics platform and retain for at least 90 days to support retroactive hunts.
Monitor for sudden appearance of new source IPs calling introspection after the CVE publication date of 2026-09-25.
Track OpenID Connect subject identifiers appearing in logs tied to multiple Relying Parties for the same end user.

How to Mitigate CVE-2026-92288

Immediate Actions Required

Upgrade Lemonldap::NG::Portal to 2.21.6 on the 2.20.x–2.21.x branch or 2.23.4 on the 2.22.x–2.23.x branch.
Inventory all registered OAuth2 Relying Parties and identify which are marked public.
Rotate any access tokens issued to public Relying Parties that may have been introspected by an untrusted party.
Review Portal logs for anomalous /oauth2/introspect traffic since the installation of an affected version.

Patch Information

Upstream fixes are available in LemonLDAP-ng Release 2.21.6 and LemonLDAP-ng Release 2.23.4. The patched checkEndPointAuthenticationCredentials() no longer treats a public client flag as sufficient authentication at the introspection endpoint. See the Openwall OSS-Security Discussion for the coordinated announcement.

Workarounds

Restrict network access to /oauth2/introspect to known resource server IP addresses using a reverse proxy ACL.
Reconfigure public Relying Parties as confidential where feasible and distribute a client secret before re-enabling introspection.
Disable the introspection endpoint on affected instances until upgrade is possible if no resource server depends on it.

bash

# Example nginx ACL restricting introspection to trusted resource servers
location = /oauth2/introspect {
    allow 10.20.30.0/24;   # resource server subnet
    allow 10.20.31.0/24;   # second resource server subnet
    deny all;
    proxy_pass http://lemonldap_portal_upstream;
}