The vulnerability arises when the checkEndPointAuthenticationCredentials function skips the client secret comparison for public relying parties. Consequently, any request that supplies a public client_id can succeed without a valid secret. An attacker who has an access token and knows the client_id of a public relying party can use the introspection endpoint to verify that the token is still active and retrieve its metadata, including scope, audience, and expiry. The sub claim returned is derived from the user identifier attribute of the calling relying party, enabling an attacker to map a user identifier from one relying party to another, thereby breaking pseudonymous identities and client isolation.

Affected versions are Lemonldap::NG::Portal for Perl from 2.20.0 up to 2.21.5, and from 2.22.0 up to 2.23.3. The fix is included in 2.21.6 and 2.23.4, available on the official release site and CPAN respectively. No other editions are impacted according to current references.

Because the introspection endpoint accepts unauthenticated requests for public client_ids, the attack requires only the client_id and an existing token. No privileged access or code execution is required. The EPSS score is < 1% and the vulnerability is not in the KEV catalog, yet its low barrier to exploitation makes it a moderate to high risk for environments that expose the introspection endpoint to the public internet. The CNA lists the fix and indicates that no remediation beyond upgrading is needed; however, isolating the endpoint or disabling public RP introspection can mitigate risk if an upgrade cannot be performed immediately.