CVE-2026-12804CWE-601

lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect

Medium · published June 21, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the component SAML Common Domain Cookie Endpoint. Performing a manipulation of the argument url results in open redirect. The attack is possible to be carried out remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue. The vendor confirms, that "it has been fixed some days ago and will be available in 2.23.1. CDC is quite never used, so the impact is very low."

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-21T18:30Z
EPSS history
Timeline
  • 21 JUN 18:30Z
    lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect
    cvelistv5