The flaw resides in the checkEndPointAuthenticationCredentials routine, which skips verifying the client secret for public Relying Parties configured in "PKCE or secret" mode. An attacker who can obtain an authorization code issued to a public RP can replay that code with any client secret, causing the token endpoint to issue access, ID, and refresh tokens. This results in unauthorized access to the target user's resources and accounts. The weakness is a validation bypass that permits credential substitution, leading to token compromise.

Lemonldap::NG::Portal in Perl, versions 2.23.0 through 2.23.3 inclusive. The issue affects any public Relying Party that has been created in "PKCE or secret" mode, including those added via dynamic client registration.

The vulnerability is exploitable remotely via a reachable authorization endpoint; it requires an attacker to intercept or otherwise obtain an authorization code for a public RP. Because the token endpoint accepts the exchange without validating the client secret when a code challenge is absent, the attack can succeed without needing privileged server access. The CVSS score is 9.1 and the EPSS score is less than 1%, indicating a high severity with a very low but non-zero exploitation probability; the issue is not listed in KEV. Nevertheless, the vulnerability permits full token theft and should be considered high risk.