CVE-2026-19349Suited to automated attack · CISA

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

CVSS score

9.8

EPSS probability

%0.8

Risk score

0.1

Published

2 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.8

CVE-2026-72887Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

VendorCPANSec ProductNet-OAuth

Patch verifiedEPSS %12 mo ago

9.8

CVE-2026-78183DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float

VendorCPANSec ProductDBD-Pg

Patch verifiedEPSS %11 mo ago

9.1

CVE-2026-73639Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

VendorCPANSec ProductImager-File-PNG+1 etkilenen

Patch verifiedEPSS %11 mo ago

9.8

CVE-2026-73193DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse

VendorCPANSec ProductDBI

Patch verifiedEPSS %12 mo ago

9.8

CVE-2026-78619Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

VendorCPANSec ProductPunk-TOTP

Patch status unknownEPSS %11 mo ago

9.1

CVE-2026-93019Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

VendorCPANSec ProductImager

Patch verifiedEPSS %11 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-19349"

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

Related Security News

Similar Vulnerabilities

Get this vulnerability through the API

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration