Lemonldap-ng vulnerabilities
We track 5 vulnerabilities in Lemonldap-ng products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on January 16, 2026.
Latest Lemonldap-ng vulnerabilities
- 7.2 High severity
LemonLDAP::NG: Improper Neutralization of Input During Web Page Generation
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.
- 8.0 High severity
LemonLDAP::NG: Improper Neutralization of Special Elements used in an OS Command
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on th
- 8.8 High severity
lemonldap-ng: Incorrect Default Permissions
An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolu
- 9.1 Critical severity
lemonldap-ng: Incorrect Authorization
Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).
- 9.8 Critical severity
Lemonldap: Improper Authentication
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after