CVE-2026-12804: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-12804 is an open redirect vulnerability in lemonldap-ng affecting all versions up to and including 2.23.0. The flaw resides in the SAML Common Domain Cookie (CDC) Endpoint component, specifically within the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm, where insufficient validation of the url argument allows an attacker to redirect users to arbitrary external sites. It was published on June 21, 2026, with a patch expected in version 2.23.1. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory).

The root cause is improper validation of user-supplied input in the url parameter handled by the CDC endpoint, classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'). An unauthenticated remote attacker can craft a malicious URL targeting the CDC endpoint with a manipulated url argument, causing the server to redirect a victim's browser to an attacker-controlled site. Exploitation requires user interaction — the victim must follow the crafted link — and no special privileges are needed. A proof-of-concept exploit has been publicly disclosed, and the fix is tracked in the upstream GitLab repository via merge request and work item (GitHub Advisory).

Successful exploitation allows an attacker to redirect authenticated or unauthenticated users from a trusted lemonldap-ng portal to an arbitrary external website, facilitating phishing attacks and credential theft. There is no direct impact on confidentiality or availability of the lemonldap-ng system itself; the integrity impact is limited to the trustworthiness of redirect destinations. The vendor notes that the CDC component is rarely used in practice, significantly limiting the real-world attack surface (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible lemonldap-ng portal instances running versions up to 2.23.0 that have the SAML Common Domain Cookie (CDC) endpoint enabled.
2. Locate the CDC endpoint: Determine the URL path for the CDC endpoint (typically accessible at the portal's CDC handler path, e.g., /cdc).
3. Craft malicious URL: Construct a URL targeting the CDC endpoint with a manipulated url parameter pointing to an attacker-controlled site, e.g., https://target-portal/cdc?url=https://attacker.example.com/phishing.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embedding in web content, leveraging the trusted lemonldap-ng domain to increase credibility.
5. Harvest credentials: When the victim clicks the link, the portal redirects them to the attacker's site, where a spoofed login page or other phishing content can be used to capture credentials or session tokens (GitHub Advisory).

• Network: Unusual outbound redirect responses (HTTP 302/301) from the lemonldap-ng CDC endpoint (/cdc) to external or unexpected domains; requests to the CDC endpoint with url parameters containing external hostnames.
• Logs: Web server or portal access logs showing requests to the CDC endpoint with url query parameters pointing to non-whitelisted or external domains; repeated access from the same source IP with varying url values.
• Application: Lemonldap-ng portal logs indicating CDC endpoint activity from users who do not typically use SAML Common Domain Cookie functionality.

The vendor has confirmed the vulnerability is fixed and will be available in lemonldap-ng version 2.23.1; upgrading to this release or later is the recommended remediation (GitHub Advisory). As an interim workaround, administrators should implement URL whitelisting or input validation on the url parameter in the CDC endpoint to restrict redirects to approved domains only. If the CDC component is not in use (the vendor notes it is rarely deployed), consider disabling or restricting access to the CDC endpoint entirely until the patch is applied.

The vendor acknowledged the vulnerability and confirmed a fix was prepared prior to public disclosure, stating: "it has been fixed some days ago and will be available in 2.23.1. CDC is quite never used, so the impact is very low." The GitHub Advisory Database classified the issue as Low severity and marked it as unreviewed. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed (GitHub Advisory).