Description

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the state session with the positional call `getApacheSession( undef, 1, 0, 'GitHubState' )`. getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a "default => accept" access rule; deployments whose rules test the user or require an authentication level are less exposed. Only configurations with the GitHub or LinkedIn authentication module enabled are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-16T14:16:54.720Z",
  "pubdate": "2026-08-16T14:16:54.720Z",
  "executiveSummary": "Lemonldap::NG::Portal contains an authentication bypass vulnerability within the GitHub and LinkedIn authentication backends affecting specific version ranges.\nThe vulnerability allows unauthenticated remote attackers to obtain a valid Single Sign-On (SSO) session without performing any authentication.\nThe root cause stems from improper argument handling during the creation of the OAuth2 state parameter via getApacheSession(), which incorrectly writes the state as a regular SSO session to the global session storage instead of a temporary token storage.\nAttackers can extract the state identifier from the redirection URL and replay it as a session cookie to gain unauthorized session access.\nThe impact depends on the deployed access rules; default configurations granting 'default => accept' access rules are fully exposed, whereas deployments testing user identity or requiring specific authentication levels have reduced exposure.\nExploitation requires the GitHub or LinkedIn authentication module to be enabled and an unauthenticated visitor to interact with the endpoints.",
  "technicalDetails": "The vulnerability resides in the session management handling within Lemonldap::NG::Portal during the initiation of OAuth2 authentication flows for the GitHub and LinkedIn backends.\nBefore redirecting to the identity provider, the extractFormInfo() function creates the state session using the positional call getApacheSession( undef, 1, 0, 'GitHubState' ).\nThe getApacheSession() function expects a session identifier followed by a named argument hash. Because positional arguments are passed instead, the trailing arguments are improperly interpreted as the named argument hash.\nConsequently, the kind parameter defaults to SSO, and the state parameter is written to the global session storage as a standard regular SSO session rather than a transient storage mechanism.\nThe resulting session identifier is then transmitted to the unauthenticated visitor as the state parameter of the redirection URL.\nAn unauthenticated visitor reaching the GitHub or LinkedIn endpoint can capture this identifier, replay it directly as a session cookie, and bypass all authentication checks to obtain a valid SSO session.\nThe resulting session lacks both the _user attribute and an authenticationLevel. However, deployments utilizing the shipped bootstrap configuration accept this state because it implements a default => accept access rule for virtual hosts.\nThe affected product is Lemonldap::NG::Portal for Perl, impacting versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, and from 2.22.0 before 2.23.3.\nPrerequisites for exploitation include having the GitHub or LinkedIn authentication module enabled within the Lemonldap::NG configuration and network access to the portal endpoints without requiring prior authentication or privileges."
}