An unauthenticated vulnerability in Lemonldap::NG::Portal allows attackers to bypass OAuth2 authentication checks, leading to unauthorized token introspection and potential user identity correlation.

The application incorrectly handles OAuth2 token introspection by skipping secret verification for public Relying Parties, which permits unauthenticated requests to successfully validate tokens and extract sensitive metadata such as user claims.

The exploitation of this flaw allows an attacker to confirm the validity of access tokens and retrieve associated user attributes, including the sub claim. This capability facilitates the correlation of user identifiers across different services, effectively breaking privacy protections and enabling unauthorized access to sensitive user information. Given the CVSS score of 9.1, this vulnerability poses a critical risk to identity management infrastructure and data confidentiality.

Immediate Action: Upgrade to Lemonldap::NG::Portal version 2.21.6 (for LTS) or 2.23.4 or later, as these releases include the necessary fix for the authentication logic.

Proactive Monitoring: Review authentication and API access logs for anomalous introspection requests originating from unknown or unauthorized clients.

Compensating Controls: If immediate patching is not possible, restrict access to the OAuth2 introspection endpoint at the network or web application firewall level to trusted internal services only.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the integrity of identity services relying on Lemonldap::NG::Portal. Administrators must prioritize the deployment of the provided patches to versions 2.21.6 or 2.23.4 to prevent unauthorized access to token metadata and protect user privacy. Failure to remediate could result in widespread identity correlation attacks against your user base.