CVE-2026-92288 | CVSS: 9.1 | 严重级别: CRITICAL
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party.
checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the authentication method deduced from the request, client_secret_basic or client_secret_post. introspection() rejects a caller only when that method is missing or none, so a request carrying a public client_id and an arbitrary
参考链接:
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719
📌 数据来源: NVD 官方