{"id":"CVE-2026-92289","revision":"907c927ed7ee4f3da81c78002afd0733","records":[{"revision":"907c927ed7ee4f3da81c78002afd0733","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92289","aliases":[],"title":"Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in \"PKCE or secret\" mode because checkEndPointAuthenticationCredentials does not verify the client secret","description":"Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in \"PKCE or secret\" mode because checkEndPointAuthenticationCredentials does not verify the client secret.\n\nWith oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present.\n\nAn attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode.","state":0,"publishedAt":"2026-09-25T00:15:49.826+00:00","modifiedAt":"2026-09-26T22:29:08.052+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"Lemonldap-NG-Portal","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Lemonldap::NG::Portal\"\n                    ],\n                    \"packageName\": \"Lemonldap-NG-Portal\",\n                    \"packageURL\": \"pkg:cpan/Lemonldap-NG-Portal\",\n                    \"programFiles\": [\n                        \"lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm\",\n                        \"lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Lemonldap::NG::Portal::Lib::OpenIDConnect::checkEndPointAuthenticationCredentials\"\n                        },\n                        {\n                            \"name\": \"Lemonldap::NG::Portal::Issuer::OpenIDConnect::token\"\n                        }\n                    ],\n                    \"repo\": \"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.23.4\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.23.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719","https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92289","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92289","identifiers":["CVE-2026-92289"]},"retained":false,"historicalAffected":[]}],"coverage":[]}