CVE-2026-92289: Lemonldap::NG::Portal PKCE Auth Bypass

CVE-2026-92289 Overview

CVE-2026-92289 is an authentication bypass vulnerability in Lemonldap::NG::Portal versions 2.23.0 through 2.23.3. The flaw allows attackers to bypass Proof Key for Code Exchange (PKCE) protections for public OpenID Connect Relying Parties configured in "PKCE or secret" mode. The checkEndPointAuthenticationCredentials function fails to verify the client secret for public Relying Parties, enabling attackers who intercept an authorization code to exchange it for the victim's access, ID, and refresh tokens. Dynamic client registration creates every Relying Party in this vulnerable mode, broadening the attack surface. The vulnerability is classified under [CWE-1390] (Weak Authentication).

Critical Impact
An attacker who intercepts an authorization code can obtain the victim's OIDC tokens by replaying the client_id with any arbitrary secret, defeating the protection PKCE is designed to provide.

Affected Products

Lemonldap::NG::Portal 2.23.0
Lemonldap::NG::Portal 2.23.1 through 2.23.3
Perl-based OIDC deployments using dynamic client registration

Discovery Timeline

2026-09-25 - CVE-2026-92289 published to NVD
2026-09-25 - Vendor releases LemonLDAP::NG 2.23.4 fixing the issue
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-92289

Vulnerability Analysis

The vulnerability resides in the token exchange flow of the LemonLDAP::NG OpenID Connect portal. When oidcRPMetaDataOptionsRequirePKCE is set to 2 ("PKCE or secret" mode), the authorization endpoint issues an authorization code even when the request carries no code_challenge. The token() method then admits the code exchange as long as either a challenge was stored or an authentication method was returned for the caller.

The checkEndPointAuthenticationCredentials() function skips the secret comparison entirely for a Relying Party marked public. It still returns the authentication method deduced from the request, which causes validatePKCEChallenge() to pass trivially because no challenge or verifier is present. Any Basic or form credential satisfies the secret branch, so the server accepts arbitrary attacker-supplied values.

Root Cause

The root cause is a logic flaw in the credential verification path for public Relying Parties. The code treats "public client" as sufficient grounds to skip secret validation while simultaneously treating the presence of credentials as proof of authentication. This creates an unconditional bypass when PKCE enforcement is not strictly required.

Attack Vector

An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's tokens. The attacker replays the client_id and sends an arbitrary secret via HTTP Basic authentication or form parameters. The token endpoint returns access, ID, and refresh tokens because neither the secret nor a PKCE verifier is validated. Because dynamic client registration provisions all Relying Parties as public in this mode, every registered client is exposed.

No verified exploit code is published. See the LemonLDAP NG Work Item #3719 for technical details of the fix.

Detection Methods for CVE-2026-92289

Indicators of Compromise

Token endpoint requests where the same client_id appears with varying or malformed client secrets, especially from unexpected source IP addresses.
Successful token exchanges for public Relying Parties lacking a corresponding code_challenge in the preceding authorization request.
Unusual issuance of refresh tokens tied to dynamically registered clients that have no production use.

Detection Strategies

Correlate authorization and token endpoint logs to flag code exchanges that complete without a prior code_challenge parameter.
Monitor checkEndPointAuthenticationCredentials behavior by enabling verbose portal logging and alerting on public Relying Party token issuance.
Baseline token requests per client_id and alert on anomalous geographic or user-agent diversity suggesting code interception.

Monitoring Recommendations

Forward LemonLDAP::NG portal logs to a centralized SIEM and alert on repeated 200-response token exchanges with mismatched credentials.
Enable TLS inspection on upstream reverse proxies to detect authorization code leakage via logs or Referer headers.
Audit dynamically registered OIDC clients weekly and remove stale or unused Relying Parties.

How to Mitigate CVE-2026-92289

Immediate Actions Required

Upgrade Lemonldap::NG::Portal to version 2.23.4 or later immediately on all portal nodes.
Review all OIDC Relying Parties configured with oidcRPMetaDataOptionsRequirePKCE = 2 and treat them as potentially compromised.
Rotate client secrets and invalidate active refresh tokens issued to public Relying Parties during the exposure window.

Patch Information

The vendor released LemonLDAP::NG 2.23.4 containing the fix. Refer to the LemonLDAP NG Release 2.23.4 notes and the Openwall OSS Security Discussion for upgrade guidance. The patched release enforces client secret verification and PKCE validation independently.

Workarounds

Set oidcRPMetaDataOptionsRequirePKCE to 1 (PKCE required) for all Relying Parties until the upgrade can be deployed.
Disable dynamic client registration if it is not operationally required to prevent attacker-controlled public client provisioning.
Restrict network access to the token endpoint and enforce short authorization code lifetimes to reduce the window for code interception.

bash

# Configuration example: enforce PKCE on all Relying Parties
# In lemonldap-ng.ini or Manager configuration
oidcRPMetaDataOptionsRequirePKCE = 1
oidcServiceAllowDynamicRegistration = 0