External risk intelligence

LemonLDAP NG Authentication Bypass via OAuth2 State Parameter

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19349

Lemonldap::NG is an identity management and SSO portal designed to be public-facing to handle authentication requests from users. Because it serves as an internet-facing gateway for identity services and authentication, it is inherently exposed to the public internet in its normal deployment role.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Lemonldap::NG::Portal, an identity management and single sign-on system. The issue, if exploited, could allow unauthenticated users to bypass authentication when using GitHub or LinkedIn for login, potentially gaining unauthorized access to protected resources. The risk is most significant for deployments that have enabled these specific authentication modules and employ default access rules.

Authentication bypass in identity portal.
Critical issue affects secure login processes.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by reaching a LemonLDAP::NG portal that uses GitHub or LinkedIn for authentication. The portal generates an unauthenticated session identifier as a state parameter for redirecting to the identity provider. An attacker can then replay this identifier as a session cookie to gain access to the portal, potentially leading to unauthorized actions if the portal's access rules are permissive.

No authentication needed for access.
Replay state parameter as session cookie.
Bypasses authentication, leading to unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

LemonLDAP::NG portals configured to use GitHub or LinkedIn for authentication could allow unauthenticated users to bypass authentication. This occurs when an attacker can replay a session identifier obtained from a redirection URL, potentially granting them access to the portal. The impact is reduced in deployments that strictly enforce user authentication or require specific authentication levels beyond what is provided by the bypassed session.

Unauthenticated access to the portal.
Replay of session identifiers via URLs.
Unauthorized access to protected resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for Lemonldap::NG instances, in conjunction with platform or infrastructure teams, should prioritize understanding the exposure of this authentication bypass vulnerability. The initial step involves identifying all deployments of the affected technology, confirming reachability from external networks, and assessing business criticality. Once these factors are understood, the accountable owner should be identified to coordinate remediation efforts, considering the specific configurations and enabled modules.

Identify affected Lemonldap::NG instances and owners.
Verify GitHub/LinkedIn module usage and reachability.
Plan remediation based on risk and configuration.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Lemonldap::NG::Portal?

Lemonldap::NG is an open-source web application that functions as an identity provider and single sign-on (SSO) gateway. It manages user authentication for various services, allowing users to log in once to access multiple web applications. Because it centralizes identity, it sits between users and the applications they need to reach.

How does CVE-2026-19349 enable authentication bypass?

This vulnerability, classified as CWE-305 (Authentication Bypass) and CWE-628 (Function Request Parameter Errors), occurs because the system mistakenly treats temporary OAuth2 state information as a valid user session. By replaying a specific identifier from an OAuth2 redirection URL as a session cookie, an unauthenticated visitor can trick the portal into treating them as an authenticated user without ever providing valid credentials.

When does this vulnerability trigger?

The flaw triggers when a user interacts with the GitHub or LinkedIn authentication modules. If the portal is configured to use these providers, it generates an identifier that an attacker can capture and reuse. Notably, this bug does not impact deployments that rely solely on other authentication methods or those where the internal access rules explicitly require verified user accounts rather than accepting default, permissive settings.

Is my instance of Lemonldap::NG at risk?

According to Halo Surface Signal, these portals are often intentionally public-facing to handle incoming authentication traffic, which increases the likelihood of exposure. You should consider your instance at risk if it is accessible from the internet and currently has the GitHub or LinkedIn authentication modules enabled.

How should I respond to CVE-2026-19349?

Start by auditing your infrastructure to locate all instances of Lemonldap::NG. Verify which of these instances have GitHub or LinkedIn authentication enabled. Once identified, consult the official project release notes to confirm your specific version is vulnerable and prioritize patching those systems to the corrected versions provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.