Lemonldap::NG::Portal permits an unauthenticated visitor to obtain a valid SSO session by reusing an OAuth2 state parameter that is stored as a session cookie. The state value is exposed in the redirect URL to GitHub or LinkedIn providers and an attacker can replay it, creating a session that lacks user or authentication level attributes. Because the shipped bootstrap configuration allows default access, such a session is accepted as fully authenticated, providing the attacker an unintentional authenticated session. The weakness is a direct Authentication Bypass (CWE-305) and a misuse of internal state handling (CWE-628).

The vulnerability affects Lemonldap::NG::Portal versions 2.0.0 up to but not including 2.16.9, 2.17.0 up to but not including 2.21.5, and 2.22.0 up to but not including 2.23.3. These releases are available from the Lemonldap-ng download site or CPAN for 2.23.3. Only configurations with the GitHub or LinkedIn authentication module enabled are exposed.

The vulnerability allows remote unauthenticated attackers to create a valid authenticated session by simply contacting the GitHub or LinkedIn endpoint, making the exploitation trivial from a network perspective. The EPSS score is not available, but the potential impact is high because any unauthenticated session can be leveraged to access the portal. The vulnerability is not listed in CISA GEVENTS (KEV). The diagonal attack vector is a remote HTTP request to the OAuth2 redirect endpoint, followed by replaying the state value as a session cookie.