CVE-2026-12804

Name of the Vulnerable Software and Affected Versions lemonldap-ng versions prior to 2.23.1

Description An issue exists in the SAML Common Domain Cookie Endpoint within the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm. A remote attacker can perform a manipulation of the url argument, leading to an open redirect. An open redirect occurs when an application takes a user-provided input and uses it in a redirect without sufficient validation, allowing attackers to redirect users to malicious external sites.

Recommendations Update to a version later than 2.23.0. Avoid using the url argument in the affected SAML Common Domain Cookie Endpoint until the update is applied.