{"id":"CVE-2019-15941","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-15941","generatedAt":"2026-10-28T20:27:33.763Z","title":"OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request.","description":"OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.","published":"2019-09-25T20:15:11.000Z","lastModified":"2026-06-17T02:21:23.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-863"],"affected":["lemonldap-ng/lemonldap\\","debian/debian linux"],"epss":{"score":0.02461,"percentile":0.84366,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://seclists.org/bugtraq/2019/Sep/46","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2019/dsa-4533","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Sep/46","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4533","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-15941","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}