Maxbes

**Name of the Vulnerable Software and Affected Versions** LemonLDAP::NG version 2.0.13 **Description** An issue was discovered in LemonLDAP::NG when using the RESTServer plug-in for a REST password validation service and the Kerberos authentication method combined with another method using the Combination authentication plug-in. In this scenario, any password will be recognized as valid for an existing user. **Recommendations** For LemonLDAP::NG version 2.0.13, consider disabling the Combination authentication plug-in or the Kerberos authentication method as a temporary workaround until a patch is available. Restrict access to the REST password validation service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LemonLDAP::NG versions 2.x through 2.0.5 **Description** The issue is related to improper authorization in the OpenID Connect Issuer of LemonLDAP::NG. It allows an attacker to bypass access control rules via a crafted OpenID Connect authorization request. This can happen if there exists an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs. Exploitation of this issue may allow a remote attacker to gain unauthorized access to information, compromising its integrity and availability, by using a specially crafted OpenID Connect authorization request. **Recommendations** For LemonLDAP::NG versions 2.x through 2.0.5, consider disabling the OpenID Connect Issuer feature until a patch is available, or ensure that all OIDC Relaying parties have strong access control rules and implement filtering on redirection URIs to minimize the risk of exploitation.