Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the state session with the positional call `getApacheSession( undef, 1, 0, 'GitHubState' )`. getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a "default => accept" access rule; deployments whose rules test the user or require an authentication level are less exposed. Only configurations with the GitHub or LinkedIn authentication module enabled are affected.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d8ffb92441 advisory.

    Update to 2.23.3     Fixes CVE-2026-19349

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-55e1334aed advisory.

    Update to 2.23.3     Fixes CVE-2026-19349

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6434 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6434-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 12, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : lemonldap-ng     CVE ID         : CVE-2026-12804 CVE-2026-19349

    It was discovered that the Lemonldap::NG web SSO system insufficiently     enforced access when using the GitHub/Linkedin authentication backends.

    For the stable distribution (trixie), these problems have been fixed in     version 2.21.2+ds-1+deb13u3.

    We recommend that you upgrade your lemonldap-ng packages.

    For the detailed security status of lemonldap-ng please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/lemonldap-ng

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before     2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the     GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the     state session with the positional call `getApacheSession( undef, 1, 0, 'GitHubState' )`.
    getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become     that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO     session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection     URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session     cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor     authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a     default => accept access rule; deployments whose rules test the user or require an authentication level     are less exposed. Only configurations with the GitHub or LinkedIn authentication module enabled are     affected. (CVE-2026-19349)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
337972	Fedora 43 : lemonldap-ng (2026-d8ffb92441)	Nessus	Fedora Local Security Checks	Local	critical
337893	Fedora 44 : lemonldap-ng (2026-55e1334aed)	Nessus	Fedora Local Security Checks	Local	critical
334970	Debian dsa-6434 : lemonldap-ng - security update	Nessus	Debian Local Security Checks	Local	medium
334494	Linux Distros Unpatched Vulnerability : CVE-2026-19349	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-19349

critical

Tenable Plugins

critical

critical

medium

critical