Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the state session with the positional call `getApacheSession( undef, 1, 0, 'GitHubState' )`. getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts becau
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Lemonldap::NG::Portal, a widely-used open-source identity provider and single sign-on (SSO) solution, contains a critical authentication bypass vulnerability in versions 2.0.0 through 2.23.3. The flaw stems from improper handling of OAuth2 state parameters during GitHub and LinkedIn backend authentication flows. When creating the state session, the code incorrectly passes positional arguments to getApacheSession() instead of using named parameters, causing the OAuth2 state to be stored as a malformed SSO session. This allows attackers to bypass authentication entirely, gaining unauthorized access to protected resources and potentially compromising accounts across all applications relying on this identity provider. Organizations using affected versions of Lemonldap::NG::Portal for enterprise SSO face immediate risk of account takeovers and unauthorized system access.
While this vulnerability doesn't map to specific MITRE ATT&CK techniques in the CVE record, Casky's Claude-powered analysis would detect the underlying attack patterns associated with Credential Access and Initial Access tactics. Practitioners using Casky would observe security findings centered on abnormal OAuth2 state parameter handling, improper session initialization, and authentication logic bypass indicators. The platform's 754 mapped security skills would flag suspicious patterns such as missing or mismatched OAuth state validation, unauthenticated session creation, and authentication mechanism circumvention—all hallmarks of CWE-305 (Missing Cryptographic Step) and CWE-628 (Function Call with Incorrectly Specified Arguments). Detection would surface in application logs as successful authentications without proper state parameter validation, allowing teams to identify exploitation attempts before full compromise occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-19349. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation