CVE-2026-12804: Open Redirect in Lemonldap-ng SAML CDC Endpoint – Patch Guidance

Technical summary

The flaw exists in the SAML Common Domain Cookie endpoint (CDC.pm) of lemonldap-ng portal, where insufficient input validation on the 'url' parameter permits an attacker to supply a malicious destination. When a user follows a crafted link, the endpoint redirects them without validating whether the target is legitimate. This is classified as CWE-601 (URL Redirection to Untrusted Site). The CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for user interaction and the integrity impact limited to credential or session hijacking scenarios rather than direct system compromise.

Business impact

The primary risk is credential harvesting and user trust erosion. Attackers can use the redirect to phish users by directing them to lookalike login pages or malicious sites, exploiting the trusted source (your lemonldap-ng domain) to bypass email filters and user skepticism. Since the CDC endpoint is rarely deployed according to vendor commentary, real-world impact is constrained, but organizations relying on it should treat this as a configuration-specific concern rather than a universal threat.

Affected systems

Lemonldap-ng versions up to and including 2.23.0 are affected. Organizations using the SAML Common Domain Cookie feature in these versions face direct risk; those without CDC configured are unaffected. The vulnerability is version-specific, and patching to 2.23.1 or later resolves the issue.

Exploitability

The exploit is straightforward and now public. An attacker simply crafts a URL with a malicious redirect target and distributes it via phishing emails, social engineering, or forum posts. Success depends entirely on user click-through, making it an effective but not autonomous attack vector. No authentication is required, and the network is accessible from the internet, making opportunistic attacks feasible against organizations with CDC enabled.

Remediation

Organizations should immediately upgrade to lemonldap-ng 2.23.1 or later. Before patching, if CDC is not actively used, disabling the feature at the proxy or application layer eliminates exposure. No workarounds exist short of disabling CDC; input validation retrofits are fragile and vendor patching is the proper remedy.

Patch guidance

Verify against the official lemonldap-ng release notes that version 2.23.1 or later is available for your deployment platform (RHEL, Debian, source build, etc.). Apply the update following your standard change-control process. Test the SAML CDC endpoint post-patch to confirm redirect validation is enforced. Monitor vendor advisories for any additional guidance on this or related open redirect vectors.

Detection guidance

Monitor HTTP access logs for the CDC endpoint for suspicious 'url' parameter values, such as those containing external domains (e.g., http/https to attacker-controlled hosts). Alert on CDC requests redirecting users outside your organization domain. Implement user-agent and referrer header inspection to catch unusual redirect patterns. If you have not deployed CDC, no active monitoring is necessary.

Why prioritize this

This is a MEDIUM-severity issue requiring prompt but not emergency attention. The low CVSS score reflects the user interaction requirement and limited scope (integrity only). However, because it is public and easily exploitable, it should be patched ahead of lower-priority updates. Organizations not using CDC can defer this further, but those with CDC active should patch within a sprint cycle (1–2 weeks).

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network accessibility with no authentication (AV:N, PR:N), (2) Low attack complexity (AC:L), (3) Requirement for user click (UI:R), and (4) Integrity impact only—an attacker can redirect users but cannot exfiltrate data or execute commands directly. The lack of availability or confidentiality impact and the need for social engineering limit the severity to MEDIUM. This does not mean the vulnerability is benign; it means successful exploitation hinges on user behavior rather than system-level flaws.

Frequently asked questions