CVE-2021-35473: Lemonldap-NG

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.

Affected products

• Lemonldap-NG Lemonldap-NG: before 2.0.12 (fixed in 2.0.12)

Published 2024-11-10. Last modified 2026-06-17.