CVE-2019-15941 - CVE House
Back to Database
Status published Critical CVE-2019-15941

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow...

Vulnerability Description

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-15941

Credits & Attribution

No credits recorded in the NVD database.

References

More from lemonldap-ng

View All →
CVE-2025-59518
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3,...
High 8
CVE-2025-31510
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS)...
High 7.2
CVE-2022-37186
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when...
Unknown 0
CVE-2021-40874
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When...
Critical 9.8
CVE-2021-35472
An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache...
High 8.8

Affected Vendor

lemonldap-ng

View all reports →

Affected Software

lemonldap\, debian linux
Vulnerable Versions:
2.0.0, 10.0

Timeline

Official Publish: September 25th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.