CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl are vulnerable to a PKCE bypass in "PKCE or secret" mode. The root cause is that the checkEndPointAuthenticationCredentials function fails to verify the client secret for public Relying Parties. When oidcRPMetaDataOptionsRequirePKC...