CVE-2026-19349

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.0.0 through 2.16.8 Lemonldap::NG::Portal versions 2.17.0 through 2.21.4 Lemonldap::NG::Portal versions 2.22.0 through 2.23.2

Description An authentication bypass exists in the GitHub and LinkedIn backends when the corresponding authentication modules are enabled. The extractFormInfo() function creates a state session using a positional call to getApacheSession(), which causes the state to be stored in global session storage as a regular Single Sign-On (SSO) session. The identifier for this session is then provided to unauthenticated visitors as the state parameter in the redirection URL. An attacker can replay this identifier as a session cookie to obtain a valid SSO session without authenticating. This is particularly critical in bootstrap configurations that grant virtual hosts a default accept access rule, as the resulting session lacks a user or authenticationLevel variable.

Recommendations Update to version 2.16.9 or later for the 2.0.x branch. Update to version 2.21.5 or later for the 2.17.x branch. Update to version 2.23.3 or later for the 2.22.x branch. Disable the GitHub or LinkedIn authentication modules if they are not required.