CVE-2019-15941

9.8 criticalEPSS 2.5%

Critical (9.8). EPSS 2.5% chance of exploitation in the next 30 days.

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2019-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
lemonldap-ng:lemonldap\

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881
https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/
https://seclists.org/bugtraq/2019/Sep/46
https://www.debian.org/security/2019/dsa-4533
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881

Check your stack JSON