CVE-2026-92288
Description
A flaw was found in lemonldap-ng. The OAuth 2.0 (Open Authorization) token introspection endpoint fails to properly verify client credentials when handling requests for public relying parties. A remote attacker possessing an access token and a public client identifier can exploit this vulnerability to perform unauthorized token introspection, resulting in information disclosure. This exposure allows an attacker to inspect token metadata, confirm token activity, and map user identity claims across different relying parties.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
