CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "Lemonldap::NG::Portal"
    ],
    "packageName": "Lemonldap-NG-Portal",
    "packageURL": "pkg:cpan/Lemonldap-NG-Portal",
    "programFiles": [
      "lib/Lemonldap/NG/Portal/Auth/GitHub.pm",
      "lib/Lemonldap/NG/Portal/Auth/LinkedIn.pm"
    ],
    "programRoutines": [
      {
        "name": "Lemonldap::NG::Portal::Auth::GitHub::extractFormInfo"
      },
      {
        "name": "Lemonldap::NG::Portal::Auth::LinkedIn::extractFormInfo"
      }
    ],
    "repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
    "versions": [
      {
        "lessThan": "2.16.9",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "2.21.5",
        "status": "affected",
        "version": "2.17.0",
        "versionType": "custom"
      },
      {
        "lessThan": "2.23.3",
        "status": "affected",
        "version": "2.22.0",
        "versionType": "custom"
      }
    ]
  }
]