CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 to

CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Rely

Reported by oss-security

Summary by Cyber Security News25 Sep 2026, 02:39 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/933

Posted by Timothy Legge on Sep 24 ======================================================================== CVE-2026-92288 CPAN Security Group ======================================================================== CVE ID: CVE-2026-92288 Distribution: Lemonldap-NG-Portal Versions: from 2.20.0 before 2.21.6 from 2.22.0 before 2.23.4 MetaCPAN: https://metacpan.org/dist/Lemonldap-NG-Portal...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction

Beta Channel Update for ChromeOS / ChromeOS Flex

3 Consulting Myths Debunked by Unit 42 Experts

CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator