CVE-2025-31510: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-31510 is a reflected cross-site scripting (XSS) vulnerability in the LemonLDAP::NG web portal that allows remote attackers to inject arbitrary web script or HTML into the login page via the tab parameter when using Choice authentication. It affects all versions of LemonLDAP::NG before 2.21.0. The CVE was received by MITRE on January 16, 2026, with a Debian LTS advisory published in April 2025. It carries a CVSS v3.1 base score of 7.2 (High), assigned by MITRE (NVD, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization of the tab URL parameter in the LemonLDAP::NG portal when the Choice authentication module is active; user-supplied input is reflected directly into the login page HTML without proper encoding. Because no authentication or special privileges are required and the attack is network-accessible with low complexity, an attacker can craft a malicious URL containing a JavaScript payload and deliver it to a victim via phishing or other social engineering. The issue is tracked in the upstream GitLab issue tracker (GitLab Issue).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the LemonLDAP::NG login page, which could lead to session token theft, credential harvesting, or redirection to malicious sites. Because the scope is changed (S:C in the CVSS vector), the injected script can affect resources beyond the vulnerable component itself. Confidentiality and integrity are both partially impacted, while availability is unaffected (NVD, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-31510. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugins (IDs 234024 and 234025) are available for scanning (Feedly, Tenable).

1. Reconnaissance: Identify publicly accessible LemonLDAP::NG portals running versions prior to 2.21.0 that have the Choice authentication method enabled, using tools like Shodan or manual browsing.
2. Craft malicious URL: Construct a URL targeting the portal login page with a malicious payload in the tab parameter, e.g., https://portal.example.com/?tab=<script>alert(document.cookie)</script> or a more sophisticated payload for credential harvesting.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, instant message, or embedded link, enticing them to click it while accessing the LemonLDAP::NG login page.
4. Payload execution: When the victim loads the URL, the unsanitized tab parameter value is reflected into the login page HTML and the injected JavaScript executes in the victim's browser, potentially stealing session cookies, capturing credentials, or redirecting the user to an attacker-controlled site (GitLab Issue, NVD).

• Network: HTTP GET requests to the LemonLDAP::NG portal login page containing script tags, encoded JavaScript, or unusual values in the tab query parameter (e.g., tab=%3Cscript%3E, tab=<img onerror=...>).
• Logs: Web server access logs showing requests to the portal URL with anomalous or encoded characters in the tab parameter; repeated requests from the same IP with varying XSS payloads.
• Browser/Client-Side: Unexpected JavaScript execution on the login page; users reporting being redirected to unknown sites or seeing unexpected pop-ups after visiting the portal login page.

The vendor has released LemonLDAP::NG version 2.21.0, which addresses this vulnerability by properly sanitizing the tab parameter. Administrators should upgrade to version 2.21.0 or later as the primary remediation. Debian users can apply the security update announced via the Debian Security Announce and Debian LTS mailing lists. As a temporary workaround, disabling the Choice authentication method (if not required) would eliminate the attack surface (GitLab Issue, Debian LTS Announce, LemonLDAP-NG Release).

The vulnerability received routine coverage from security aggregators and Linux distribution security teams, including Debian's security and LTS announcement lists. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries and scanner plugin releases (Debian Security, Tenable).