CVE-2026-95811: Lemonldap::NG::Handler Auth Bypass Vulnerability

CVE-2026-95811 Overview

CVE-2026-95811 is an access control bypass in the Lemonldap::NG::Handler Perl module. The handler evaluates locationRules regular expressions against the raw REQUEST_URI, while the upstream web server routes on the already percent-decoded and normalized path. Attackers can craft an equivalent spelling of a URL — using percent-encoding, dot segments, or doubled slashes — that bypasses the restrictive rule and falls through to the vhost's default rule. The flaw affects Lemonldap::NG::Handler versions 2.0.0 before 2.16.10, 2.17.0 before 2.21.6, and 2.22.0 before 2.23.4. It is categorized under [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize].

Critical Impact
An authenticated user can reach any URL that a locationRules regexp was meant to restrict, bypassing deny rules, identity and group conditions, and unprotect and skip rules.

Affected Products

Lemonldap::NG::Handler for Perl, versions 2.0.0 before 2.16.10
Lemonldap::NG::Handler for Perl, versions 2.17.0 before 2.21.6
Lemonldap::NG::Handler for Perl, versions 2.22.0 before 2.23.4

Discovery Timeline

2026-09-25 - CVE-2026-95811 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-95811

Vulnerability Analysis

LemonLDAP::NG is a Web Single Sign-On (WebSSO) and access management solution. The handler component enforces per-vhost access policies defined as locationRules, which are ordered regular expressions evaluated against the incoming request. When a request arrives, the handler reads REQUEST_URI — the raw request line as received — and matches each rule regex against that string. If no rule matches, the vhost default rule governs access.

The mismatch arises because the fronting web server (Apache, Nginx) performs its own canonicalization before dispatching the request. The server routes on the decoded and normalized path, but the handler sees the original raw URI. Any encoding that preserves the server's routing decision but changes the string the regex sees produces a bypass.

Root Cause

The root cause is a classic validate-before-canonicalize flaw [CWE-180]. The handler applies security-relevant regular expressions to a non-canonical form of the URL. Protected paths encoded as /%61dmin, /./admin, or //admin will not match a ^/admin rule yet still reach the admin resource after the web server normalizes them.

Attack Vector

Exploitation requires an authenticated user and a vhost whose default rule is more permissive than its targeted locationRules. The attacker rewrites the path portion of a request using any of three equivalent spellings — percent-encoding of unreserved characters, insertion of . or .. segments, or duplicated slash characters. The request bypasses deny, identity, group, unprotect, and skip rules, falling through to the default rule. The attacker gains no privilege beyond what the default rule already grants to authenticated users.

See the LemonLDAP-ng Issue #3723 for technical discussion. This issue is related to the earlier CVE-2020-24660 Record.

Detection Methods for CVE-2026-95811

Indicators of Compromise

Access log entries containing percent-encoded alphanumeric characters in request paths (for example %61, %2e, %2f) targeting resources normally restricted by locationRules.
Requests containing /./, /../, or // segments against protected vhosts, followed by HTTP 200 responses where 403 is expected.
Authenticated session activity reaching URLs that should be denied by identity or group conditions on the vhost.

Detection Strategies

Compare the raw REQUEST_URI in handler logs against the normalized path logged by the upstream web server; divergence on protected vhosts indicates attempted bypass.
Enable LemonLDAP::NG verbose access logging and alert on access to resources covered by non-default locationRules when the request contains encoding artifacts.
Correlate authenticated user identifiers with access to sensitive endpoints they are not entitled to under their group or role mapping.

Monitoring Recommendations

Ingest Apache or Nginx access logs and LemonLDAP::NG handler logs into a central analytics platform to detect URI-normalization divergence.
Monitor for repeated 200-response requests from a single authenticated session containing %, ./, or // sequences against the same vhost.
Track rule evaluation outcomes if the handler is configured to log matched rule names, flagging requests that resolve to the default rule but target restricted paths.

How to Mitigate CVE-2026-95811

Immediate Actions Required

Upgrade Lemonldap::NG::Handler to version 2.16.10, 2.21.6, or 2.23.4 depending on your deployed branch.
Audit each vhost configuration and tighten the default rule where it is more permissive than named locationRules; the vulnerability has no effect when the default rule is at least as restrictive.
Review authentication and access logs for the exploitation patterns described above since the first vulnerable version was deployed.

Patch Information

Fixes are available in the following upstream releases: LemonLDAP-ng Release v2.16.10, LemonLDAP-ng Release v2.21.6, and LemonLDAP-ng Release v2.23.4. Debian users should apply the update described in the Debian LTS Announcement.

Workarounds

Set the vhost defaultRule to deny (or an equivalent restrictive expression) and explicitly allow only the paths intended to be reachable, inverting the trust model so a bypass falls into a deny state.
Configure the fronting web server to reject requests containing encoded path characters, dot segments, or duplicated slashes before they reach the handler.
Normalize REQUEST_URI at the reverse proxy layer using rewrite rules that decode and collapse the path before the handler evaluates it.

bash

# Example Apache mod_rewrite rules to reject non-canonical paths
RewriteEngine On
RewriteCond %{THE_REQUEST} \s[^?]*(?:%[0-9A-Fa-f]{2}|/\./|/\.\./|//) [NC]
RewriteRule ^ - [R=400,L]