Lemonldap::NG::Portal OAuth2 Token Introspection Authentication Bypass

Lemonldap::NG::Portal versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4 for Perl contain an authentication bypass in OAuth2 token introspection. The checkEndPointAuthenticationCredentials function does not verify the client secret of a public Relying Party, allowing unauthenticated requests to pass the endpoint's authentication check.

An attacker who holds an access token and knows the client_id of any public Relying Party can confirm the token is active and read its metadata, including scope, audience, expiry, and the sub claim. This can be used to translate a user identifier from one Relying Party to another, defeating per-client and pseudonymous identifiers.

• Affected versions: 2.20.0 before 2.21.6, 2.22.0 before 2.23.4
• Requires: knowledge of a public client_id and possession of an access token
• Impact: token metadata disclosure and cross-Relying Party user identifier correlation