CVE-2024-45160: 
Linux Debian vulnerability analysis and mitigation

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret). The vulnerability was discovered in August 2024 and has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) (CISA ADP).

The vulnerability stems from a regression introduced in LemonLDAP::NG 2.18.0 where the authentication method 'none' is accepted even when the client is not configured as a public client. When processing OAuth2 token requests, the system incorrectly accepts empty client secrets, allowing unauthorized access (GitLab Issue). The vulnerability has been classified under CWE-863 (Incorrect Authorization) with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

This vulnerability allows remote attackers to bypass OAuth2 client authentication mechanisms, potentially gaining unauthorized access to protected resources. The high CVSS score of 9.1 indicates critical severity with potential for significant confidentiality and integrity breaches (CISA ADP).

The vulnerability has been fixed in LemonLDAP::NG version 2.19.2. Users are strongly advised to upgrade to this version or later. The fix was implemented through a series of commits that properly validate OAuth2 client authentication methods (GitLab Commits).