CVE-2019-15941

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-25 · updated 2026-06-17
Weakness: CWE-863

Description

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.

Affected products

Debian Linux: 10.0
lemonldap-ng Lemonldap::Ng: from 2.0.0 through 2.0.5

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881
https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/
https://seclists.org/bugtraq/2019/Sep/46
https://www.debian.org/security/2019/dsa-4533
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881
https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/
https://seclists.org/bugtraq/2019/Sep/46
https://www.debian.org/security/2019/dsa-4533

Get alerted when CVE-2019-15941 or the next vulnerability affects your stack